CVE-2025-71395

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 2.2.2

Description An authenticated attacker can cause a denial of service by crafting a malicious query that triggers memory exhaustion. This occurs in the string::replace() function, which fails to restrict the length of the resulting string when regex patterns are used, leading to unbounded string allocations.

Recommendations Update SurrealDB to version 2.2.2 or later. As a temporary mitigation, restrict the use of the string::replace() function with regex patterns.