EUVD-2025-210484
GHSA-w8p8-58rp-4rqp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the non-default scripting configuration prerequisite; PR:L for required authentication; no confidentiality or integrity impact, availability impact is high.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
SurrealDB before 2.2.2 with scripting enabled fails to properly enforce recursion limits when native functions contain embedded JavaScript that issues new queries. Authenticated attackers can bypass the recursion limit by chaining native and JavaScript function calls to trigger infinite recursion and exhaust server memory.
AnalysisAI
Memory exhaustion in SurrealDB's scripting subsystem allows authenticated users to bypass the server's recursion depth limit by chaining native function calls with embedded JavaScript that issues new queries, triggering infinite recursion and depleting server memory. Affected versions span all SurrealDB releases before 2.0.5, 2.1.0-2.1.4, and 2.2.0-2.2.1, but only when the scripting capability is explicitly enabled via a non-default flag. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV; however, any authenticated user on an exposed instance can reliably cause a denial of service.
Technical ContextAI
SurrealDB is a multi-model database written in Rust that optionally supports embedded JavaScript scripting through a capability gate (--allow-scripting / SURREAL_CAPS_ALLOW_SCRIPT=true). The engine enforces separate recursion depth limits for native SurrealQL functions and for JavaScript functions, but these limits are evaluated independently per call-chain boundary. CWE-674 (Uncontrolled Recursion) is the root cause: when a native function embeds JavaScript that calls surrealdb.query() to re-invoke the same native function, the cross-boundary hop resets or bypasses the depth counter, allowing infinite recursion to proceed until the OS terminates the process or RAM is exhausted. The affected CPE is cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:* across multiple branches of the Rust crate. The fix, developed following a cure53 code audit and penetration test, further restricts scripting recursion depth and disallows parallel surrealdb.query() calls within a single scripting function.
RemediationAI
Upgrade SurrealDB to a patched release corresponding to your deployment branch: 2.0.5 for 2.0.x, 2.1.5 for 2.1.x, or 2.2.2 (or any later release) for 2.2.x and current deployments. If an immediate upgrade is not feasible, disable embedded scripting by starting SurrealDB with the --deny-scripting flag or by setting SURREAL_CAPS_DENY_SCRIPT=true; this trade-off fully eliminates the attack surface but removes all SurrealQL JavaScript scripting functionality, which may break applications relying on embedded JS queries. Note that scripting is disabled by default - instances not explicitly using --allow-scripting, --allow-all, SURREAL_CAPS_ALLOW_SCRIPT=true, or SURREAL_CAPS_ALLOW_ALL=true require no action. Full advisory and patch details: https://github.com/surrealdb/surrealdb/security/advisories/GHSA-m7rc-8w7m-r9qr.
Privilege escalation via second-order SurrealQL injection in SurrealDB before 2.0.5, 2.1.5, and 2.2.2 lets an authentica
Privilege escalation in SurrealDB before v3.1.0 lets unauthenticated attackers hijack the privileges of concurrently-act
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the database with a single Web
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the entire database process wi
Session hijacking in SurrealDB before 3.1.0 lets unauthenticated attackers enumerate attached session UUIDs through the
Cross-tenant authorization bypass in SurrealDB before 3.2.0 lets any authenticated user reach custom API endpoints belon
Arbitrary file read in SurrealDB before 3.1.5 lets an authenticated database user holding the EDITOR or OWNER role discl
Confused-deputy privilege escalation in SurrealDB before 2.5.0 and before 3.0.0-beta.3 lets a low-privileged user (e.g.
Denial of service in SurrealDB before 3.1.5 lets an authenticated user with query-execution privileges crash the entire
Denial of service in SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 lets an authenticated user with
Information disclosure in SurrealDB before 3.1.0 allows authenticated record or scope users to bypass table-level SELECT
Denial of service in SurrealDB before 2.2.2 allows any authenticated user to crash the database by submitting a crafted
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today