CVE-2025-71397 (GCVE-0-2025-71397)
Vulnerability from cvelistv5
Published
2026-07-18 13:10
Modified
2026-10-29 21:15
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Summary
SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 allows authenticated users with OWNER or EDITOR permissions (at the root, namespace, or database level) to define custom database functions via DEFINE FUNCTION using nested FOR loops. Although a single loop's iteration count is constrained, nesting multiple loops (e.g., each with 1,000,000 iterations) is not, so an attacker can execute a function that consumes all server CPU time. Configured timeouts do not stop the execution, rendering the server unresponsive to other queries and connections until it is manually restarted.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-71397",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-20T15:12:40.333706Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T15:12:51.105Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:cargo/surrealdb",
"product": "surrealdb",
"vendor": "surrealdb",
"versions": [
{
"lessThan": "2.2.2",
"status": "affected",
"version": "2.2.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.2.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:cargo/surrealdb",
"product": "surrealdb",
"vendor": "surrealdb",
"versions": [
{
"lessThan": "2.1.5",
"status": "affected",
"version": "2.1.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.1.5",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:cargo/surrealdb",
"product": "surrealdb",
"vendor": "surrealdb",
"versions": [
{
"lessThan": "2.0.5",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.0.5",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.2.2",
"versionStartIncluding": "2.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.1.5",
"versionStartIncluding": "2.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "cure53"
}
],
"datePublic": "2025-04-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 allows authenticated users with OWNER or EDITOR permissions (at the root, namespace, or database level) to define custom database functions via DEFINE FUNCTION using nested FOR loops. Although a single loop\u0027s iteration count is constrained, nesting multiple loops (e.g., each with 1,000,000 iterations) is not, so an attacker can execute a function that consumes all server CPU time. Configured timeouts do not stop the execution, rendering the server unresponsive to other queries and connections until it is manually restarted."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-835",
"description": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T21:15:23.434Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-pxw4-94j3-v9pf)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-pxw4-94j3-v9pf"
},
{
"name": "VulnCheck Advisory: SurrealDB before 2.2.2 CPU Exhaustion via nested FOR loops",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/surrealdb-before-cpu-exhaustion-via-nested-for-loops"
}
],
"title": "SurrealDB before 2.2.2 CPU Exhaustion via nested FOR loops",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2025-71397",
"datePublished": "2026-07-18T13:10:15.129Z",
"dateReserved": "2026-07-16T12:14:41.770Z",
"dateUpdated": "2026-10-29T21:15:23.434Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-71397\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-20T15:12:40.333706Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-20T15:12:45.994Z\"}}], \"cna\": {\"title\": \"SurrealDB before 2.2.2 CPU Exhaustion via nested FOR loops\", \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"cure53\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 7.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"surrealdb\", \"product\": \"surrealdb\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.2.0\", \"lessThan\": \"2.2.2\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"2.2.2\", \"versionType\": \"semver\"}], \"packageURL\": \"pkg:cargo/surrealdb\", \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"surrealdb\", \"product\": \"surrealdb\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.1.0\", \"lessThan\": \"2.1.5\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"2.1.5\", \"versionType\": \"semver\"}], \"packageURL\": \"pkg:cargo/surrealdb\", \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"surrealdb\", \"product\": \"surrealdb\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"2.0.5\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"2.0.5\", \"versionType\": \"semver\"}], \"packageURL\": \"pkg:cargo/surrealdb\", \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2025-04-10T00:00:00.000Z\", \"references\": [{\"url\": \"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-pxw4-94j3-v9pf\", \"name\": \"GitHub Security Advisory (GHSA-pxw4-94j3-v9pf)\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://www.vulncheck.com/advisories/surrealdb-before-cpu-exhaustion-via-nested-for-loops\", \"name\": \"VulnCheck Advisory: SurrealDB before 2.2.2 CPU Exhaustion via nested FOR loops\", \"tags\": [\"third-party-advisory\"]}], \"x_generator\": {\"engine\": \"vulncheck-endgame\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 allows authenticated users with OWNER or EDITOR permissions (at the root, namespace, or database level) to define custom database functions via DEFINE FUNCTION using nested FOR loops. Although a single loop\u0027s iteration count is constrained, nesting multiple loops (e.g., each with 1,000,000 iterations) is not, so an attacker can execute a function that consumes all server CPU time. Configured timeouts do not stop the execution, rendering the server unresponsive to other queries and connections until it is manually restarted.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-835\", \"description\": \"Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"2.2.2\", \"versionStartIncluding\": \"2.2.0\"}, {\"criteria\": \"cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"2.1.5\", \"versionStartIncluding\": \"2.1.0\"}, {\"criteria\": \"cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"2.0.5\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"83251b91-4cc7-4094-a5c7-464a1b83ea10\", \"shortName\": \"VulnCheck\", \"dateUpdated\": \"2026-10-29T21:15:23.434Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2025-71397\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-29T21:15:23.434Z\", \"dateReserved\": \"2026-07-16T12:14:41.770Z\", \"assignerOrgId\": \"83251b91-4cc7-4094-a5c7-464a1b83ea10\", \"datePublished\": \"2026-07-18T13:10:15.129Z\", \"assignerShortName\": \"VulnCheck\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…