EUVD-2025-210488
GHSA-33m9-4q46-9q55
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable SurrealQL interface (AV:N) with low complexity, but defining functions requires OWNER/EDITOR privileges (PR:L); impact is pure availability DoS (A:H) with no confidentiality or integrity effect and no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 allows authenticated users with OWNER or EDITOR permissions (at the root, namespace, or database level) to define custom database functions via DEFINE FUNCTION using nested FOR loops. Although a single loop's iteration count is constrained, nesting multiple loops (e.g., each with 1,000,000 iterations) is not, so an attacker can execute a function that consumes all server CPU time. Configured timeouts do not stop the execution, rendering the server unresponsive to other queries and connections until it is manually restarted.
AnalysisAI
Denial of service in SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 lets an authenticated user with OWNER or EDITOR rights define a custom function containing nested FOR loops that bypasses per-loop iteration limits and consumes all server CPU, ignoring configured query timeouts. The multiplicative iteration count (e.g. several nested loops of 1,000,000 each) monopolizes the process until it is manually killed, blocking all other queries and new connections. Discovered during a cure53 audit; no public exploit identified at time of analysis and it is not on CISA KEV, though the technique is trivially reproducible from the advisory.
Technical ContextAI
SurrealDB is a Rust-based multi-model database that exposes SurrealQL, a query language supporting user-defined logic via the DEFINE FUNCTION statement and FOR loop control flow. The root cause is CWE-835 (Loop with Unreachable Exit Condition / infinite loop): while the parser and interpreter cap the iteration count of a single FOR loop, they do not bound the combined cost of nested loops, so nesting N loops of one million iterations yields up to 10^(6N) executions. Critically, the ForEachStatement iteration path did not check for context cancellation, meaning configured statement/transaction timeouts never fired during the tight loop. The fix (PR #5597) adds a per-iteration check for context cancellation or timeout inside ForEachStatement so long-running loops can be aborted. Affected CPE is cpe:2.3:a:surrealdb:surrealdb across the listed version ranges.
RemediationAI
Vendor-released patch: upgrade to SurrealDB 2.0.5, 2.1.5, or 2.2.2 (or later), which add a per-iteration context-cancellation/timeout check in ForEachStatement (fix in PR https://github.com/surrealdb/surrealdb/pull/5597; advisory GHSA-pxw4-94j3-v9pf). For deployments that cannot upgrade immediately, restrict custom function execution using the capabilities controls: set --deny-functions (or SURREAL_CAPS_DENY_FUNC) to block all custom functions, or use --allow-functions / SURREAL_CAPS_ALLOW_FUNC to permit only a vetted allowlist of trusted functions (see https://surrealdb.com/docs/surrealdb/security/capabilities#functions); the trade-off is that legitimate custom SurrealQL functions will be blocked or limited, which may break application logic. As a complementary control, minimize the number of principals granted OWNER or EDITOR at root/namespace/database scope, since those roles are the exploitation prerequisite.
Privilege escalation via second-order SurrealQL injection in SurrealDB before 2.0.5, 2.1.5, and 2.2.2 lets an authentica
Privilege escalation in SurrealDB before v3.1.0 lets unauthenticated attackers hijack the privileges of concurrently-act
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the database with a single Web
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the entire database process wi
Session hijacking in SurrealDB before 3.1.0 lets unauthenticated attackers enumerate attached session UUIDs through the
Cross-tenant authorization bypass in SurrealDB before 3.2.0 lets any authenticated user reach custom API endpoints belon
Arbitrary file read in SurrealDB before 3.1.5 lets an authenticated database user holding the EDITOR or OWNER role discl
Confused-deputy privilege escalation in SurrealDB before 2.5.0 and before 3.0.0-beta.3 lets a low-privileged user (e.g.
Denial of service in SurrealDB before 3.1.5 lets an authenticated user with query-execution privileges crash the entire
Information disclosure in SurrealDB before 3.1.0 allows authenticated record or scope users to bypass table-level SELECT
Denial of service in SurrealDB before 2.2.2 allows any authenticated user to crash the database by submitting a crafted
Broken authorization in SurrealDB before 3.1.4 allows record-scoped (authenticated) users to read array elements that fi
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today