CVE-2025-71393
Full vulnerability record from the local CVENow database.
Description
SurrealDB before 2.2.2 with scripting enabled fails to properly enforce recursion limits when native functions contain embedded JavaScript that issues new queries. Authenticated attackers can bypass the recursion limit by chaining native and JavaScript function calls to trigger infinite recursion and exhaust server memory.
Severity
MEDIUM
CVSS score
6.0
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-07-18 14:17:10.703000
Last modified
2026-10-29 21:17:05.927000
View original CVE JSON
{
"id": "CVE-2025-71393",
"sourceIdentifier": "[email protected]",
"published": "2026-07-18T14:17:10.703",
"lastModified": "2026-10-29T21:17:05.927",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "SurrealDB before 2.2.2 with scripting enabled fails to properly enforce recursion limits when native functions contain embedded JavaScript that issues new queries. Authenticated attackers can bypass the recursion limit by chaining native and JavaScript function calls to trigger infinite recursion and exhaust server memory."
},
{
"lang": "es",
"value": "SurrealDB anterior a 2.2.2 con scripting habilitado no aplica correctamente los límites de recursión cuando las funciones nativas contienen JavaScript incrustado que emite nuevas consultas. Atacantes autenticados pueden eludir el límite de recursión encadenando llamadas a funciones nativas y JavaScript para desencadenar recursión infinita y agotar la memoria del servidor."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "surrealdb",
"product": "surrealdb",
"defaultStatus": "unaffected",
"packageURL": "pkg:cargo/surrealdb",
"versions": [
{
"version": "2.2.0",
"lessThan": "2.2.2",
"versionType": "semver",
"status": "affected"
},
{
"version": "2.2.2",
"versionType": "semver",
"status": "unaffected"
}
]
},
{
"vendor": "surrealdb",
"product": "surrealdb",
"defaultStatus": "unaffected",
"packageURL": "pkg:cargo/surrealdb",
"versions": [
{
"version": "2.1.0",
"lessThan": "2.1.5",
"versionType": "semver",
"status": "affected"
},
{
"version": "2.1.5",
"versionType": "semver",
"status": "unaffected"
}
]
},
{
"vendor": "surrealdb",
"product": "surrealdb",
"defaultStatus": "unaffected",
"packageURL": "pkg:cargo/surrealdb",
"versions": [
{
"version": "0",
"lessThan": "2.0.5",
"versionType": "semver",
"status": "affected"
},
{
"version": "2.0.5",
"versionType": "semver",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 6.0,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-20T17:02:48.522453Z",
"id": "CVE-2025-71393",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-674"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.5",
"matchCriteriaId": "D8978D31-3395-4155-8DFF-99FED3F8D7DA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.1.0",
"versionEndExcluding": "2.1.5",
"matchCriteriaId": "0D7A2AEC-83EE-46CC-BC91-D5EA1B841E96"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.2.0",
"versionEndExcluding": "2.2.2",
"matchCriteriaId": "B4D2EDCC-A5D1-477A-ADA9-A32389A7D0BE"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-m7rc-8w7m-r9qr",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://www.vulncheck.com/advisories/surrealdb-before-memory-exhaustion-via-nested-functions",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
}
]
}