CVE-2025-71396CWE-770denial-of-service

CVE-2025-71396

Medium · published July 18, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
45.3
In the wild
Unconfirmed
What it is

SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 does not enforce a default execution-time limit on embedded JavaScript scripting functions when the scripting capability is explicitly enabled (via --allow-scripting or --allow-all). An authenticated attacker can submit long-running JavaScript functions to exhaust server resources and cause a denial of service. Scripting is disabled by default.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00551 · 45.3th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-07-18T18:17Z
Affected products (3)
ProductVersionsFixed in
surrealdb/surrealdb< 2.0.52.0.5
surrealdb/surrealdb≥ 2.1.0, < 2.1.52.1.5
surrealdb/surrealdb≥ 2.2.0, < 2.2.22.2.2
References (2)
https://github.com/surrealdb/surrealdb/security/advisories/GHSA-3824-qmfq-2qv7 · [email protected]https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-javascript-scripting · [email protected]
EPSS history
Timeline
  • 18 JUL 13:10Z
    SurrealDB before 2.2.2 Denial of Service via JavaScript Scripting
    cvelistv5