CVE-2025-71391CWE-248

CVE-2025-71391

Medium · published July 18, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
45.5
In the wild
Unconfirmed
What it is

SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module that allows authenticated users to crash the database. Attackers can send crafted HTTP queries containing null bytes to the /sql endpoint, causing an unhandled exception that crashes the SurrealDB instance and any dependent applications.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00555 · 45.5th percentile
Weakness
CWE-248 · Uncaught Exception
Published
2026-07-18T18:17Z
Affected products (1)
ProductVersionsFixed in
surrealdb/surrealdb< 2.2.22.2.2
References (2)
https://github.com/surrealdb/surrealdb/security/advisories/GHSA-rq86-9m6r-cm3g · [email protected]https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-sql-endpoint · [email protected]
EPSS history
Timeline
  • 18 JUL 13:10Z
    SurrealDB before 2.2.2 Denial of Service via /sql endpoint
    cvelistv5