← Back

CVE-2025-71393

nvd nist
Published: Jul 18, 2026Modified: Aug 13, 2026

JSON object

Loading...
6.0
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Show more
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less
Source: disclosure@vulncheck.com (Secondary)

Description

SurrealDB before 2.2.2 with scripting enabled fails to properly enforce recursion limits when native functions contain embedded JavaScript that issues new queries. Authenticated attackers can bypass the recursion limit by chaining native and JavaScript function calls to trigger infinite recursion and exhaust server memory.

Affected (3)

Products: Surrealdb: Surrealdb
Surrealdb
1 product
Surrealdb
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
Surrealdb
Surrealdb
Before 2.0.5
Surrealdb
From 2.1.0 to 2.1.5
Surrealdb
From 2.2.0 to 2.2.2

Related CWEs

CWE-674
Uncontrolled Recursion
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

References (2)

Source: disclosure@vulncheck.com
Vendor Advisory
Source: disclosure@vulncheck.com
Third Party Advisory

Timeline

No history available yet.