CVE-2025-71397

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 2.0.5 SurrealDB versions 2.1.x prior to 2.1.5 SurrealDB versions 2.2.x prior to 2.2.2

Description Authenticated users with OWNER or EDITOR permissions at the root, namespace, or database level can cause a denial of service. By using the DEFINE FUNCTION statement to create custom database functions containing nested FOR loops, an attacker can bypass iteration constraints. While a single loop is limited, nesting multiple loops allows for an execution that consumes all server CPU resources. This condition persists regardless of configured timeouts, making the server unresponsive to other queries and connections until a manual restart is performed.

Recommendations Update SurrealDB to version 2.0.5 or later. Update SurrealDB 2.1.x to version 2.1.5 or later. Update SurrealDB 2.2.x to version 2.2.2 or later.