CVE-2025-71395CWE-789

CVE-2025-71395

Medium · published July 18, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
38.1
In the wild
Unconfirmed
What it is

SurrealDB versions before 2.2.2 contain a memory exhaustion vulnerability in the string::replace function that fails to restrict resulting string length when using regex patterns. An authenticated attacker can craft a malicious query to exhaust server memory through unbounded string allocations, causing denial of service.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00450 · 38.1th percentile
Weakness
CWE-789 · Memory Allocation with Excessive Size Value
Published
2026-07-18T18:17Z
Affected products (3)
ProductVersionsFixed in
surrealdb/surrealdb< 2.0.52.0.5
surrealdb/surrealdb≥ 2.1.0, < 2.1.52.1.5
surrealdb/surrealdb≥ 2.2.0, < 2.2.22.2.2
References (2)
https://github.com/surrealdb/surrealdb/security/advisories/GHSA-3633-g6mg-p6qq · [email protected]https://www.vulncheck.com/advisories/surrealdb-before-memory-exhaustion-via-string-replace · [email protected]
EPSS history
Timeline
  • 18 JUL 13:10Z
    SurrealDB before 2.2.2 Memory Exhaustion via string::replace
    cvelistv5