Vulnerability · Published Jul 18, 2026 · Assigned by VulnCheck

CVE-2025-71390SurrealDB before 2.3.6 deny-net Bypass via DNS Resolution

Medium 5.8

In plain English

A medium-severity incorrect authorization in surrealdb from surrealdb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 39% of all known vulnerabilities).

Severity (CVSS 4.0)5.8Medium

Exploit odds (30 days)0.5%top 60.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SurrealDB before 2.2.6, 2.3.6, and 2.1.8 (and 3.0.0-alpha.7 and earlier) fails to validate DNS-resolved hostnames against --deny-net network access restrictions in its http::* functions. An authenticated user can invoke http::<fn>(<url>) with a hostname that resolves to a denied IP address, causing the server to issue the request anyway and return the response. This bypasses network access controls, allowing access to restricted internal endpoints and potentially retrieving or altering sensitive information and credentials, depending on the deployment.

Affected products (as reported)

Vendor	Product	Versions
surrealdb	surrealdb	0 – through 2.1.72.2.0 – before 2.2.62.3.0 – before 2.3.63.0.0-alpha.1 – through 3.0.0-alpha.7

Weakness: CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H

References

GitHub Security Advisory (GHSA-m3c3-78fh-w3w7) vendor-advisory
VulnCheck Advisory: SurrealDB before 2.3.6 deny-net Bypass via DNS Resolution third-party-advisory