Denial of service via nested loop functions in SurrealDB (CVE-2025-71397)

SurrealDB contains a denial-of-service vulnerability in which authenticated users with OWNER or EDITOR permissions at the root, namespace, or database level can define custom database functions using nested FOR loops with large iteration counts. Although individual loop iterations are constrained, nesting multiple loops is not, allowing an attacker to monopolize all server CPU time; configured timeouts do not halt execution, rendering the server unresponsive to all queries and connections until it is manually restarted. Affected versions: - < 2.0.5 - < 2.1.5 - < 2.2.2 We recommend updating to: 2.0.5, 2.1.5, 2.2.2. CVSS 7.1 · our assessment: this_week Vendor advisory: https://github.com/surrealdb/surrealdb/security/advisories/GHSA-pxw4-94j3-v9pf Details: https://vuln.today/cve/CVE-2025-71397