EUVD-2025-210491
GHSA-x3fg-mm84-q54h
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Exception handling completeness
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 18, 2026
Denial of service in SurrealDB before 2.2.2 allows any authenticated user to crash the database by submitting a crafted query whose result contains a null byte to the /sql HTTP endpoint. The null byte triggers an uncaught exception during JSON serialization of the query response in the net module, terminating the process and any application that depends on it. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; the reported CVSS 4.0 base score is 7.1 (availability-only impact).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in cargo
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Surrealdb gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module that allows authenticated users to crash the database. Attackers can send crafted HTTP queries containing null bytes to the /sql endpoint, causing an unhandled exception that crashes the SurrealDB instance and any dependent applications.
Executive ViewAI
SurrealDB versions prior to 2.2.2 contain a denial-of-service vulnerability allowing any authenticated database user to crash the entire database service via a specially crafted query. Organizations depending on SurrealDB face potential service outages and application downtime from malicious or compromised database accounts.
Within 24 hours, audit all SurrealDB deployments in production to identify versions and document database user accounts with access. Within 7 days, implement network segmentation to restrict SurrealDB access to essential systems only and enable comprehensive authentication and query logging. Within 30 days, plan and execute an upgrade to SurrealDB 2.2.2 or later when available; if upgrade timeline is blocked, evaluate alternative database solutions to mitigate dependency on a vulnerable product.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to SurrealDB to trusted internal systems only, enforce strong authentication with principle of least privilege, implement database audit logging focused on detecting null-byte patterns in queries, and consider application-layer query validation to reject requests containing null bytes before submission to the database.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Privilege escalation via second-order SurrealQL injection in SurrealDB before 2.0.5, 2.1.5, and 2.2.2 lets an authentica
Privilege escalation in SurrealDB before v3.1.0 lets unauthenticated attackers hijack the privileges of concurrently-act
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the database with a single Web
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the entire database process wi
Session hijacking in SurrealDB before 3.1.0 lets unauthenticated attackers enumerate attached session UUIDs through the
SurrealDB versions before 3.3.0 fail to validate a caller's authorization level when the SurrealQL USE statement switche
Cross-tenant data access in SurrealDB before 3.3.0 allows an authenticated namespace- or database-level SYSTEM user to b
Cross-tenant authorization bypass in SurrealDB before 3.2.0 lets any authenticated user reach custom API endpoints belon
Arbitrary file read in SurrealDB before 3.1.5 lets an authenticated database user holding the EDITOR or OWNER role discl
Confused-deputy privilege escalation in SurrealDB before 2.5.0 and before 3.0.0-beta.3 lets a low-privileged user (e.g.
Denial of service in SurrealDB before 3.1.5 lets an authenticated user with query-execution privileges crash the entire
Denial of service in SurrealDB versions before 3.3.0 lets a query-capable authenticated user with embedded JavaScript sc
Exploit-DB