Memory exhaustion in SurrealDB string::replace (CVE-2025-71395)

SurrealDB contains a memory exhaustion vulnerability in the string::replace function whereby the use of regex patterns imposes no restriction on the resulting string length. An authenticated attacker can exploit this by sending a crafted query to the server, exhausting all available memory through unbounded string allocations and causing a denial of service. Affected versions: - < 2.2.2 - < 2.1.5 - < 2.0.5 We recommend updating to: 2.2.2, 2.1.5, 2.0.5. CVSS 7.1 · our assessment: this_week Vendor advisory: https://github.com/surrealdb/surrealdb/security/advisories/GHSA-3633-g6mg-p6qq Details: https://vuln.today/cve/CVE-2025-71395