{"id":"CVE-2025-71393","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-07-18T14:17:10.703","lastModified":"2026-10-29T21:17:05.927","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"SurrealDB before 2.2.2 with scripting enabled fails to properly enforce recursion limits when native functions contain embedded JavaScript that issues new queries. Authenticated attackers can bypass the recursion limit by chaining native and JavaScript function calls to trigger infinite recursion and exhaust server memory."},{"lang":"es","value":"SurrealDB anterior a 2.2.2 con scripting habilitado no aplica correctamente los límites de recursión cuando las funciones nativas contienen JavaScript incrustado que emite nuevas consultas. Atacantes autenticados pueden eludir el límite de recursión encadenando llamadas a funciones nativas y JavaScript para desencadenar recursión infinita y agotar la memoria del servidor."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"surrealdb","product":"surrealdb","defaultStatus":"unaffected","packageURL":"pkg:cargo/surrealdb","versions":[{"version":"2.2.0","lessThan":"2.2.2","versionType":"semver","status":"affected"},{"version":"2.2.2","versionType":"semver","status":"unaffected"}]},{"vendor":"surrealdb","product":"surrealdb","defaultStatus":"unaffected","packageURL":"pkg:cargo/surrealdb","versions":[{"version":"2.1.0","lessThan":"2.1.5","versionType":"semver","status":"affected"},{"version":"2.1.5","versionType":"semver","status":"unaffected"}]},{"vendor":"surrealdb","product":"surrealdb","defaultStatus":"unaffected","packageURL":"pkg:cargo/surrealdb","versions":[{"version":"0","lessThan":"2.0.5","versionType":"semver","status":"affected"},{"version":"2.0.5","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-20T17:02:48.522453Z","id":"CVE-2025-71393","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-674"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*","versionEndExcluding":"2.0.5","matchCriteriaId":"D8978D31-3395-4155-8DFF-99FED3F8D7DA"},{"vulnerable":true,"criteria":"cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*","versionStartIncluding":"2.1.0","versionEndExcluding":"2.1.5","matchCriteriaId":"0D7A2AEC-83EE-46CC-BC91-D5EA1B841E96"},{"vulnerable":true,"criteria":"cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*","versionStartIncluding":"2.2.0","versionEndExcluding":"2.2.2","matchCriteriaId":"B4D2EDCC-A5D1-477A-ADA9-A32389A7D0BE"}]}]}],"references":[{"url":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-m7rc-8w7m-r9qr","source":"disclosure@vulncheck.com","tags":["Vendor Advisory"]},{"url":"https://www.vulncheck.com/advisories/surrealdb-before-memory-exhaustion-via-nested-functions","source":"disclosure@vulncheck.com","tags":["Third Party Advisory"]}]}