EUVD-2025-210484
GHSA-w8p8-58rp-4rqp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the non-default scripting configuration prerequisite; PR:L for required authentication; no confidentiality or integrity impact, availability impact is high.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
SurrealDB before 2.2.2 with scripting enabled fails to properly enforce recursion limits when native functions contain embedded JavaScript that issues new queries. Authenticated attackers can bypass the recursion limit by chaining native and JavaScript function calls to trigger infinite recursion and exhaust server memory.
AnalysisAI
Memory exhaustion in SurrealDB's scripting subsystem allows authenticated users to bypass the server's recursion depth limit by chaining native function calls with embedded JavaScript that issues new queries, triggering infinite recursion and depleting server memory. Affected versions span all SurrealDB releases before 2.0.5, 2.1.0-2.1.4, and 2.2.0-2.2.1, but only when the scripting capability is explicitly enabled via a non-default flag. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV; however, any authenticated user on an exposed instance can reliably cause a denial of service.
Technical ContextAI
SurrealDB is a multi-model database written in Rust that optionally supports embedded JavaScript scripting through a capability gate (--allow-scripting / SURREAL_CAPS_ALLOW_SCRIPT=true). The engine enforces separate recursion depth limits for native SurrealQL functions and for JavaScript functions, but these limits are evaluated independently per call-chain boundary. CWE-674 (Uncontrolled Recursion) is the root cause: when a native function embeds JavaScript that calls surrealdb.query() to re-invoke the same native function, the cross-boundary hop resets or bypasses the depth counter, allowing infinite recursion to proceed until the OS terminates the process or RAM is exhausted. The affected CPE is cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:* across multiple branches of the Rust crate. The fix, developed following a cure53 code audit and penetration test, further restricts scripting recursion depth and disallows parallel surrealdb.query() calls within a single scripting function.
RemediationAI
Upgrade SurrealDB to a patched release corresponding to your deployment branch: 2.0.5 for 2.0.x, 2.1.5 for 2.1.x, or 2.2.2 (or any later release) for 2.2.x and current deployments. If an immediate upgrade is not feasible, disable embedded scripting by starting SurrealDB with the --deny-scripting flag or by setting SURREAL_CAPS_DENY_SCRIPT=true; this trade-off fully eliminates the attack surface but removes all SurrealQL JavaScript scripting functionality, which may break applications relying on embedded JS queries. Note that scripting is disabled by default - instances not explicitly using --allow-scripting, --allow-all, SURREAL_CAPS_ALLOW_SCRIPT=true, or SURREAL_CAPS_ALLOW_ALL=true require no action. Full advisory and patch details: https://github.com/surrealdb/surrealdb/security/advisories/GHSA-m7rc-8w7m-r9qr.
Privilege escalation via second-order SurrealQL injection in SurrealDB before 2.0.5, 2.1.5, and 2.2.2 lets an authentica
Denial of service in SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 lets an authenticated user with
Denial of service in SurrealDB before 2.2.2 allows any authenticated user to crash the database by submitting a crafted
Denial of service in SurrealDB before 2.2.2 lets an authenticated user crash the database by calling the string::replace
Server-side request forgery in SurrealDB before versions 2.0.5, 2.1.5, and 2.2.2 allows authenticated users to circumven
DNS rebinding SSRF bypass in SurrealDB's http::* query functions allows authenticated low-privileged users to reach inte
SurrealDB versions 3.0.0 through 3.1.4 expose a query-planner authorization bypass that allows authenticated record user
Local file read via DEFINE ANALYZER in SurrealDB before versions 2.1.5 and 2.2.2 allows authenticated users holding root
Resource exhaustion in SurrealDB's embedded JavaScript scripting feature allows authenticated users to deny service by s
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today