CVE-2025-71395
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Memory exhaustion vulnerability in SurrealDB before version 2.2.2 in the string::replace function that fails to restrict resulting string length when using regex patterns. An authenticated attacker can craft a malicious query to exhaust server memory, causing denial of service.
Risk Assessment
Risk includes unavailability of SurrealDB database due to memory exhaustion, potentially disrupting applications relying on this database.
Recommendation
Upgrade SurrealDB to version 2.2.2 or later and restrict user permissions to execute regex queries.
Other vulnerabilities in SurrealDB
See all- CVE-2026-63763High
Privilege escalation vulnerability in SurrealDB before 2.5.0 and 3.0.0-beta.3. Unprivileged users can create or modify fields containing futures, functions, or closures that execute in the context of a privileged user, leading to privilege escalation up to server takeover.
- CVE-2026-63762Medium
SurrealDB before version 2.6.1 (and before 3.0.0-beta.3) contains a denial of service vulnerability in the JavaScript engine. A user able to execute queries can construct a large string and pass it to compilation, causing a null pointer dereference and server crash.
- CVE-2026-63761Medium
SurrealDB before 3.1.0 silently substitutes ES512 with ES384 when JWT access is configured with ALGORITHM ES512, due to missing ES512 support in the jsonwebtoken crate v10.x. This causes curve mismatch (P-521 vs P-384) and authentication failures. The flaw cannot be used to forge tokens or compromise data confidentiality.
- CVE-2026-63760High
SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSocket /rpc endpoint to exhaust server memory and crash the process.
- CVE-2026-63759Medium
SurrealDB before version 3.1.0 fails to enforce recursion depth limits in the type/kind parser. Authenticated attackers can send queries with deeply nested type annotations, exhausting server memory and crashing the process.
- CVE-2026-63758Medium
SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability in the KILL statement, allowing authenticated database users to terminate other users' LIVE SELECT subscriptions. Attackers can issue KILL statements with target live query UUIDs to disrupt real-time data subscriptions without ownership verification.
- CVE-2026-63757High
Vulnerability in SurrealDB before version 3.1.0. The HTTP /rpc sessions method returns session UUIDs without authentication and accepts arbitrary session fields without ownership verification. Unauthenticated attackers can enumerate session UUIDs and impersonate authenticated sessions to read, write, delete data and escalate privileges.
- CVE-2026-63756High
Time-of-check/time-of-use race condition in SurrealDB before version 3.1.0 in the HTTP /rpc endpoint. Unauthenticated requests can inherit authenticated session state, allowing privilege hijacking.
- CVE-2026-63755Medium
SurrealDB before version 3.1.0 evaluates user-supplied WHERE clauses before enforcing PERMISSIONS FOR SELECT WHERE restrictions. An authenticated user can read the full contents of any table in the database, bypassing table-level permission checks. The vulnerability is confined to the current database.
- CVE-2026-63754Medium
In SurrealDB before 3.1.0, malicious LIVE queries with WHERE clauses that evaluate to errors cause all CREATE, UPDATE, and DELETE operations on the watched table to fail. An authenticated user with select-only permissions can block writes for any user, including root.
Original NVD description (English source)
SurrealDB versions before 2.2.2 contain a memory exhaustion vulnerability in the string::replace function that fails to restrict resulting string length when using regex patterns. An authenticated attacker can craft a malicious query to exhaust server memory through unbounded string allocations, causing denial of service.