CVE-2025-71395 — surrealdb
Fix: surrealdb/surrealdb#5619CVE-2025-71395 is a CWE-789 vulnerability in surrealdb. A fix is available for surrealdb — see the affected versions and patch details below.
SurrealDB before 2.2.2 Memory Exhaustion via string::replace
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2025-71395.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
Real-World Exposure
surrealdb🦀surrealdb🦀surrealdbReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects crates.io packages — download data is not available via public APIs for these ecosystems.
Description
An authenticated user can craft a query using the string::replace function that uses a Regex to perform a string replacement. As there is a failure to restrict the resulting string length, this enables an attacker to send a string::replace function to the SurrealDB server exhausting all the memory of the server due to string allocations. This eventually results in a Denial-of-Service situation for the SurrealDB server.
This issue was discovered and patched during an code audit and penetration test of SurrealDB by cure53. Using CVSSv4 definitions, the severity is High.
Impact
An authenticated user can crash the SurrealDB instance through memory exhaustion
Patches
A patch has been created that enforces a limit on string length SURREAL_GENERATION_ALLOCATION_LIMIT
- Versions 2.0.5, 2.1.5, 2.2.2, and later are not affected by this issue
Workarounds
Affected users who are unable to update may want to limit the ability of untrusted clients to run the string::replace function in the affected versions of SurrealDB using the --deny-functions flag described within Capabilities or the equivalent SURREAL_CAPS_DENY_FUNC environment variable.
References
SurrealQL Documentation - DB Functions (string::replace) SurrealDB Documentation - Capabilities SurrealDB Documentation - Environment Variables #5619 #5638
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🦀crates.io | surrealdb | ≥ 2.2.0&&< 2.2.2 | 2.2.2cargo update -p surrealdb --precise 2.2.2 |
| 🦀crates.io | surrealdb | ≥ 2.1.0&&< 2.1.5 | 2.1.5cargo update -p surrealdb --precise 2.1.5 |
| 🦀crates.io | surrealdb | all versions | 2.0.5cargo update -p surrealdb --precise 2.0.5 |
Affected Products
surrealdbsurrealdbDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for surrealdb, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update surrealdb to 2.2.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2025-71395 is resolved across your whole dependency graph.
Workarounds
Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.
Frequently Asked Questions
Is CVE-2025-71395 in your dependencies?
Find it across crates.io, including transitive dependencies.