EUVD-2025-210486
GHSA-849x-5qr7-wxfm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable low-complexity query needing a valid low-privilege authenticated session (PR:L), no interaction, availability-only impact so C:N/I:N/A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
SurrealDB versions before 2.2.2 contain a memory exhaustion vulnerability in the string::replace function that fails to restrict resulting string length when using regex patterns. An authenticated attacker can craft a malicious query to exhaust server memory through unbounded string allocations, causing denial of service.
AnalysisAI
Denial of service in SurrealDB before 2.2.2 lets an authenticated user crash the database by calling the string::replace function with a regex pattern that produces an unbounded output string, exhausting server memory. The flaw spans the 2.0.x, 2.1.x, and 2.2.x release lines and was discovered during a cure53 security audit; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is availability-only with no confidentiality or integrity loss, rated CVSS 4.0 7.1 High.
Technical ContextAI
SurrealDB is a Rust-based multi-model database that exposes the SurrealQL query language, which ships built-in string functions. The string::replace function accepts a regular-expression pattern for match-and-replace, but the implementation did not cap the size of the resulting allocated string. This is a textbook CWE-789 (Memory Allocation with Excessive Size Value): an attacker-controlled operation drives an allocation whose size is not bounded against any limit, so a query that expands a string enormously forces the server to allocate memory until the process is starved. The remediation adds a configurable ceiling exposed as SURREAL_GENERATION_ALLOCATION_LIMIT. The affected component is cpe:2.3:a:surrealdb:surrealdb across the vulnerable version ranges.
RemediationAI
Upgrade to the fixed release on your branch - SurrealDB 2.0.5, 2.1.5, or 2.2.2 (or later) - each of which enforces a string-length ceiling via SURREAL_GENERATION_ALLOCATION_LIMIT; the fixes landed in pull requests https://github.com/surrealdb/surrealdb/pull/5619 and https://github.com/surrealdb/surrealdb/pull/5638. If immediate upgrade is not possible, the vendor-recommended workaround is to prevent untrusted clients from calling the vulnerable function by denying it in SurrealDB capabilities using the --deny-functions flag or the equivalent SURREAL_CAPS_DENY_FUNC environment variable (see https://surrealdb.com/docs/surrealdb/security/capabilities#functions and https://surrealdb.com/docs/surrealdb/cli/env); the side effect is that any legitimate application logic relying on string::replace will stop working, so scope the deny rule to that specific function rather than blanket-denying string functions. As additional containment, restrict database access to trusted authenticated principals and run SurrealDB under an OS/container memory limit so a single crash does not destabilize the host.
Privilege escalation via second-order SurrealQL injection in SurrealDB before 2.0.5, 2.1.5, and 2.2.2 lets an authentica
Denial of service in SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 lets an authenticated user with
Denial of service in SurrealDB before 2.2.2 allows any authenticated user to crash the database by submitting a crafted
Memory exhaustion in SurrealDB's scripting subsystem allows authenticated users to bypass the server's recursion depth l
Server-side request forgery in SurrealDB before versions 2.0.5, 2.1.5, and 2.2.2 allows authenticated users to circumven
DNS rebinding SSRF bypass in SurrealDB's http::* query functions allows authenticated low-privileged users to reach inte
SurrealDB versions 3.0.0 through 3.1.4 expose a query-planner authorization bypass that allows authenticated record user
Local file read via DEFINE ANALYZER in SurrealDB before versions 2.1.5 and 2.2.2 allows authenticated users holding root
Resource exhaustion in SurrealDB's embedded JavaScript scripting feature allows authenticated users to deny service by s
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today