SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module that allows authenticated users to crash the database. Attackers can send crafted HTTP queries containing null bytes to the /sql endpoint, causing an unhandled exception that crashes the SurrealDB instance and any dependent applications.
CVE-2025-71391
CVSS base score
6.5 (v3.1)
Severity
MEDIUM
Attack vector
Network
Weakness
CWE-248
Last modified
October 29, 2026
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
surrealdb surrealdb
References
- github.com Vendor Advisory
- www.vulncheck.com Third Party Advisory