Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 4 total.
Uncaught exception in SurrealDB's net module (CVE-2025-71391)
CVE-2025-71391 is an uncaught exception vulnerability in SurrealDB's net module, triggered when a crafted HTTP query containing a null byte is sent to the /sql endpoint, causing JSON conversion to fail with an unhandl...
Fixed in 2.2.2; 2.1.5; 2.0.5
SurrealQL injection in SurrealDB export command (CVE-2025-71392)
SurrealDB's command-line export command fails to properly escape table and field names, enabling SurrealQL injection in exported backup files. An authenticated System User with OWNER or EDITOR roles can craft maliciou...
Fixed in 2.0.5; 2.1.5; 2.2.2
Memory exhaustion in SurrealDB string::replace (CVE-2025-71395)
SurrealDB contains a memory exhaustion vulnerability in the string::replace function whereby the use of regex patterns imposes no restriction on the resulting string length. An authenticated attacker can exploit this ...
Fixed in 2.2.2; 2.1.5; 2.0.5
Denial of service via nested loop functions in SurrealDB (CVE-2025-71397)
SurrealDB contains a denial-of-service vulnerability in which authenticated users with OWNER or EDITOR permissions at the root, namespace, or database level can define custom database functions using nested FOR loops ...
Fixed in 2.0.5; 2.1.5; 2.2.2