{"id":"EUVD-2025-210487","enisaUuid":"d8b0fa4d-946a-315c-87a6-6f47b37b57c3","description":"SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 does not enforce a default execution-time limit on embedded JavaScript scripting functions when the scripting capability is explicitly enabled (via --allow-scripting or --allow-all). An authenticated attacker can submit long-running JavaScript functions to exhaust server resources and cause a denial of service. Scripting is disabled by default.","datePublished":"Jul 18, 2026, 1:10:14 PM","dateUpdated":"Oct 29, 2026, 9:15:22 PM","baseScore":2.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-3824-qmfq-2qv7\nhttps://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-javascript-scripting\n","aliases":"CVE-2025-71396\nGHSA-6g9r-xqrf-34xh\n","assigner":"VulnCheck","epss":0.55,"enisaIdProduct":[{"id":"1a5d32c8-a44a-3617-a13a-b68504ab46c0","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"2.1.0 \u003c2.1.5"},{"id":"818a0ddb-2ed8-3f1f-9f1f-2c382db5bf81","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"0 \u003c2.0.5"},{"id":"903effb7-4eb2-3c9b-969a-c634f6eec542","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"2.2.0 \u003c2.2.2"}],"enisaIdVendor":[{"id":"c03970a1-8903-39ea-ba7f-ff666ad00e0c","vendor":{"name":"surrealdb"}}],"enisaIdVulnerability":[{"id":"01341ae6-6b39-3f31-adee-29427a8617b5","vulnerability":{"id":"CVE-2025-71396","description":"SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 does not enforce a default execution-time limit on embedded JavaScript scripting functions when the scripting capability is explicitly enabled (via --allow-scripting or --allow-all). An authenticated attacker can submit long-running JavaScript functions to exhaust server resources and cause a denial of service. Scripting is disabled by default.","datePublished":"Jul 18, 2026, 1:10:14 PM","dateUpdated":"Oct 29, 2026, 9:15:22 PM","status":"PUBLISHED","baseScore":2.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-3824-qmfq-2qv7\nhttps://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-javascript-scripting\n","enisa_id":"EUVD-2025-210487\n","assigner":"VulnCheck","epss":0.55,"dataProcessed":"Oct 30, 2026, 3:00:42 AM","vulnerabilityProduct":[{"id":"07ba6feb-851f-3519-aa1d-4e83bd445e3a","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"2.1.0 \u003c2.1.5"},{"id":"4bbf5f87-a486-339a-ba00-e6f25126353e","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"2.2.0 \u003c2.2.2"},{"id":"b2f3e1fc-1872-36ee-9461-9f1a06e76a74","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"0 \u003c2.0.5"}],"vulnerabilityVendor":[{"id":"7e0f2a25-9751-3bfb-8161-6e9885940434","vendor":{"name":"surrealdb"}}]}},{"id":"b1418970-e085-3208-811c-c513ed382bde","vulnerability":{"id":"GHSA-6g9r-xqrf-34xh","description":"Duplicate Advisory: SurrealDB no JavaScript script function default timeout could facilitate DoS","datePublished":"Jul 18, 2026, 3:31:49 PM","dateUpdated":"Sep 3, 2026, 8:09:42 PM","baseScore":0.0,"references":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-3824-qmfq-2qv7\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-71396\nhttps://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-javascript-scripting\n","enisa_id":"EUVD-2025-210487\n","aliases":"GHSA-6g9r-xqrf-34xh\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}