Vulnerabilities CVE-2025-71393

CVE-2025-71393

Medium

Open

TLP:CLEAR

SurrealDB before 2.2.2 Memory Exhaustion via Nested Functions

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

SurrealDB before 2.2.2 with scripting enabled fails to properly enforce recursion limits when native functions contain embedded JavaScript that issues new queries. Authenticated attackers can bypass the recursion limit by chaining native and JavaScript function calls to trigger infinite recursion and exhaust server memory.

Details

CVSS Score: 6.0
EPSS Score ⓘ: 0.25%

16.3th percentile
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Confidence: 90%
Published: Jul 18, 2026
Last Modified: Jul 28, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.