CVE-2025-71393

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 2.2.2

Description When scripting is enabled, the system fails to properly enforce recursion limits in cases where native functions contain embedded JavaScript that issues new queries. Authenticated attackers can bypass these limits by chaining native and JavaScript function calls, leading to infinite recursion and the exhaustion of server memory.

Recommendations Update to version 2.2.2 or later. Disable scripting functionality as a temporary mitigation measure.