Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 allows authenticated users with OWNER or EDITOR permissions (at the root, namespace, or database level) to define custom database functions via DEFINE FUNCTION using nested FOR loops. Although a single loop's iteration count is constrained, nesting multiple loops (e.g., each with 1,000,000 iterations) is not, so an attacker can execute a function that consumes all server CPU time. Configured timeouts do not stop the execution, rendering the server unresponsive to other queries and connections until it is manually restarted.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2025-71397 Denial of Service via Nested Loop Execution in SurrealDB Before 2.2.2 https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-71397
Post summary
The post discloses a Denial of Service vulnerability in SurrealDB versions prior to 2.2.2, noting the technical mechanism but not providing PoC or exploitation evidence.
CVE-2025-71397 SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 allows authenticated users with OWNER or EDITOR permissions (at the root, namespace, or database le… https://www.cve.org/CVERecord?id=CVE-2025-71397
Post summary
The excerpt announces a new CVE (CVE-2025-71397) affecting SurrealDB versions prior to 2.2.2, noting that authenticated users with elevated permissions can exploit the flaw, but does not provide evidence of exploitation, a PoC, or a patch.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | surrealdb | surrealdb | - | - | - |