SurrealDB before 2.2.2 with scripting enabled fails to properly enforce recursion limits when native functions contain embedded JavaScript that issues new queries. Authenticated attackers can bypass the recursion limit by chaining native and JavaScript function calls to trigger infinite recursion and exhaust server memory.
CVE-2025-71393
CVSS base score
6.5 (v3.1)
Severity
MEDIUM
Attack vector
Network
Weakness
CWE-674
Last modified
October 29, 2026
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
surrealdb surrealdb
References
- github.com Vendor Advisory
- www.vulncheck.com Third Party Advisory