EUVD-2025-210488
GHSA-33m9-4q46-9q55
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable SurrealQL interface (AV:N) with low complexity, but defining functions requires OWNER/EDITOR privileges (PR:L); impact is pure availability DoS (A:H) with no confidentiality or integrity effect and no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 allows authenticated users with OWNER or EDITOR permissions (at the root, namespace, or database level) to define custom database functions via DEFINE FUNCTION using nested FOR loops. Although a single loop's iteration count is constrained, nesting multiple loops (e.g., each with 1,000,000 iterations) is not, so an attacker can execute a function that consumes all server CPU time. Configured timeouts do not stop the execution, rendering the server unresponsive to other queries and connections until it is manually restarted.
AnalysisAI
Denial of service in SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 lets an authenticated user with OWNER or EDITOR rights define a custom function containing nested FOR loops that bypasses per-loop iteration limits and consumes all server CPU, ignoring configured query timeouts. The multiplicative iteration count (e.g. several nested loops of 1,000,000 each) monopolizes the process until it is manually killed, blocking all other queries and new connections. Discovered during a cure53 audit; no public exploit identified at time of analysis and it is not on CISA KEV, though the technique is trivially reproducible from the advisory.
Technical ContextAI
SurrealDB is a Rust-based multi-model database that exposes SurrealQL, a query language supporting user-defined logic via the DEFINE FUNCTION statement and FOR loop control flow. The root cause is CWE-835 (Loop with Unreachable Exit Condition / infinite loop): while the parser and interpreter cap the iteration count of a single FOR loop, they do not bound the combined cost of nested loops, so nesting N loops of one million iterations yields up to 10^(6N) executions. Critically, the ForEachStatement iteration path did not check for context cancellation, meaning configured statement/transaction timeouts never fired during the tight loop. The fix (PR #5597) adds a per-iteration check for context cancellation or timeout inside ForEachStatement so long-running loops can be aborted. Affected CPE is cpe:2.3:a:surrealdb:surrealdb across the listed version ranges.
RemediationAI
Vendor-released patch: upgrade to SurrealDB 2.0.5, 2.1.5, or 2.2.2 (or later), which add a per-iteration context-cancellation/timeout check in ForEachStatement (fix in PR https://github.com/surrealdb/surrealdb/pull/5597; advisory GHSA-pxw4-94j3-v9pf). For deployments that cannot upgrade immediately, restrict custom function execution using the capabilities controls: set --deny-functions (or SURREAL_CAPS_DENY_FUNC) to block all custom functions, or use --allow-functions / SURREAL_CAPS_ALLOW_FUNC to permit only a vetted allowlist of trusted functions (see https://surrealdb.com/docs/surrealdb/security/capabilities#functions); the trade-off is that legitimate custom SurrealQL functions will be blocked or limited, which may break application logic. As a complementary control, minimize the number of principals granted OWNER or EDITOR at root/namespace/database scope, since those roles are the exploitation prerequisite.
Privilege escalation via second-order SurrealQL injection in SurrealDB before 2.0.5, 2.1.5, and 2.2.2 lets an authentica
Denial of service in SurrealDB before 2.2.2 allows any authenticated user to crash the database by submitting a crafted
Denial of service in SurrealDB before 2.2.2 lets an authenticated user crash the database by calling the string::replace
Memory exhaustion in SurrealDB's scripting subsystem allows authenticated users to bypass the server's recursion depth l
Server-side request forgery in SurrealDB before versions 2.0.5, 2.1.5, and 2.2.2 allows authenticated users to circumven
DNS rebinding SSRF bypass in SurrealDB's http::* query functions allows authenticated low-privileged users to reach inte
SurrealDB versions 3.0.0 through 3.1.4 expose a query-planner authorization bypass that allows authenticated record user
Local file read via DEFINE ANALYZER in SurrealDB before versions 2.1.5 and 2.2.2 allows authenticated users holding root
Resource exhaustion in SurrealDB's embedded JavaScript scripting feature allows authenticated users to deny service by s
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today