EUVD-2025-210486
GHSA-849x-5qr7-wxfm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable low-complexity query needing a valid low-privilege authenticated session (PR:L), no interaction, availability-only impact so C:N/I:N/A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
SurrealDB versions before 2.2.2 contain a memory exhaustion vulnerability in the string::replace function that fails to restrict resulting string length when using regex patterns. An authenticated attacker can craft a malicious query to exhaust server memory through unbounded string allocations, causing denial of service.
AnalysisAI
Denial of service in SurrealDB before 2.2.2 lets an authenticated user crash the database by calling the string::replace function with a regex pattern that produces an unbounded output string, exhausting server memory. The flaw spans the 2.0.x, 2.1.x, and 2.2.x release lines and was discovered during a cure53 security audit; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is availability-only with no confidentiality or integrity loss, rated CVSS 4.0 7.1 High.
Technical ContextAI
SurrealDB is a Rust-based multi-model database that exposes the SurrealQL query language, which ships built-in string functions. The string::replace function accepts a regular-expression pattern for match-and-replace, but the implementation did not cap the size of the resulting allocated string. This is a textbook CWE-789 (Memory Allocation with Excessive Size Value): an attacker-controlled operation drives an allocation whose size is not bounded against any limit, so a query that expands a string enormously forces the server to allocate memory until the process is starved. The remediation adds a configurable ceiling exposed as SURREAL_GENERATION_ALLOCATION_LIMIT. The affected component is cpe:2.3:a:surrealdb:surrealdb across the vulnerable version ranges.
RemediationAI
Upgrade to the fixed release on your branch - SurrealDB 2.0.5, 2.1.5, or 2.2.2 (or later) - each of which enforces a string-length ceiling via SURREAL_GENERATION_ALLOCATION_LIMIT; the fixes landed in pull requests https://github.com/surrealdb/surrealdb/pull/5619 and https://github.com/surrealdb/surrealdb/pull/5638. If immediate upgrade is not possible, the vendor-recommended workaround is to prevent untrusted clients from calling the vulnerable function by denying it in SurrealDB capabilities using the --deny-functions flag or the equivalent SURREAL_CAPS_DENY_FUNC environment variable (see https://surrealdb.com/docs/surrealdb/security/capabilities#functions and https://surrealdb.com/docs/surrealdb/cli/env); the side effect is that any legitimate application logic relying on string::replace will stop working, so scope the deny rule to that specific function rather than blanket-denying string functions. As additional containment, restrict database access to trusted authenticated principals and run SurrealDB under an OS/container memory limit so a single crash does not destabilize the host.
Privilege escalation via second-order SurrealQL injection in SurrealDB before 2.0.5, 2.1.5, and 2.2.2 lets an authentica
Privilege escalation in SurrealDB before v3.1.0 lets unauthenticated attackers hijack the privileges of concurrently-act
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the database with a single Web
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the entire database process wi
Session hijacking in SurrealDB before 3.1.0 lets unauthenticated attackers enumerate attached session UUIDs through the
Cross-tenant authorization bypass in SurrealDB before 3.2.0 lets any authenticated user reach custom API endpoints belon
Arbitrary file read in SurrealDB before 3.1.5 lets an authenticated database user holding the EDITOR or OWNER role discl
Confused-deputy privilege escalation in SurrealDB before 2.5.0 and before 3.0.0-beta.3 lets a low-privileged user (e.g.
Denial of service in SurrealDB before 3.1.5 lets an authenticated user with query-execution privileges crash the entire
Denial of service in SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 lets an authenticated user with
Information disclosure in SurrealDB before 3.1.0 allows authenticated record or scope users to bypass table-level SELECT
Denial of service in SurrealDB before 2.2.2 allows any authenticated user to crash the database by submitting a crafted
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today