CVE-2025-71397 surrealdb CVE debrief

Who should care

Defenders responsible for SurrealDB deployments, particularly those with untrusted or semi-trusted users, should assess exposure and prioritize remediation to prevent potential denial-of-service attacks.

Why it matters

Authenticated users can cause CPU exhaustion via nested FOR loops in SurrealDB, potentially leading to denial-of-service attacks and impacting server performance and availability.

• Potential denial-of-service attacks via CPU exhaustion.
• Possible impact on server performance and availability.

Technical summary

SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 allows authenticated users with OWNER or EDITOR permissions to define custom database functions via DEFINE FUNCTION using nested FOR loops, potentially consuming all server CPU time and leading to denial-of-service attacks. The vulnerability is due to the lack of constraints on nested loop iterations, enabling an attacker to execute a function that consumes all server CPU time. Configured timeouts do not stop the execution, rendering the server unresponsive.

Defensive priority

Defenders should prioritize verifying exposure and applying remediation to prevent potential denial-of-service attacks.

Recommended defensive actions

• Verify exposure by checking SurrealDB versions and user permissions.
• Apply remediation by upgrading to SurrealDB version 2.0.5, 2.1.5, or 2.2.2.
• Monitor server performance and implement compensating controls to prevent potential denial-of-service attacks.
• Review and update incident response plans to address potential impacts of denial-of-service attacks.
• Conduct regular security audits to identify and address potential vulnerabilities in SurrealDB deployments.
• Implement additional security measures, such as limiting user permissions and monitoring system performance.
• technicalSummary

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including affected versions and potential impacts. The vulnerability allows authenticated users with OWNER or EDITOR permissions to define custom database functions via DEFINE FUNCTION using nested FOR loops. Although a single loop's iteration count is constrained, nesting multiple loops is not, enabling an attacker to execute a function that consumes all server CPU time. Configured timeouts do not stop the execution, rendering the server unresponsive to other queries.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.