Uncaught exception in SurrealDB's net module (CVE-2025-71391)

CVE-2025-71391 is an uncaught exception vulnerability in SurrealDB's net module, triggered when a crafted HTTP query containing a null byte is sent to the /sql endpoint, causing JSON conversion to fail with an unhandled exception. Any authenticated user can exploit this to crash the SurrealDB instance and any application backend depending on it, constituting a denial-of-service condition. Affected versions: - < 2.2.2 - < 2.1.5 - < 2.0.5 We recommend updating to: 2.2.2, 2.1.5, 2.0.5. CVSS 7.1 · our assessment: this_week Vendor advisory: https://github.com/surrealdb/surrealdb/security/advisories/GHSA-rq86-9m6r-cm3g Details: https://vuln.today/cve/CVE-2025-71391