VULNERABILITY INTELLIGENCE

CVE-2025-71393

CVSS score6.5 MEDIUM
EPSS probability0.46%
CISA KEVNot currently listed
Published2026-07-18
Last modified2026-10-29
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Description

SurrealDB before 2.2.2 with scripting enabled fails to properly enforce recursion limits when native functions contain embedded JavaScript that issues new queries. Authenticated attackers can bypass the recursion limit by chaining native and JavaScript function calls to trigger infinite recursion and exhaust server memory.

Weakness classification

  • disclosure@vulncheck.com: CWE-674

Primary references