Vulnerability · Published Jul 18, 2026 · Assigned by VulnCheck

CVE-2025-71396SurrealDB before 2.2.2 Denial of Service via JavaScript Scripting

Low 2.3

In plain English

A low-severity resource allocation without limits in surrealdb from surrealdb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 46% of all known vulnerabilities).

Severity (CVSS 4.0)2.3Low

Exploit odds (30 days)0.6%top 53.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 does not enforce a default execution-time limit on embedded JavaScript scripting functions when the scripting capability is explicitly enabled (via --allow-scripting or --allow-all). An authenticated attacker can submit long-running JavaScript functions to exhaust server resources and cause a denial of service. Scripting is disabled by default.

Affected products (as reported)

Vendor	Product	Versions
surrealdb	surrealdb	2.2.0 – before 2.2.2
surrealdb	surrealdb	0 – before 2.0.5
surrealdb	surrealdb	2.1.0 – before 2.1.5

Weakness: CWE-770 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

GitHub Security Advisory (GHSA-3824-qmfq-2qv7) vendor-advisory
VulnCheck Advisory: SurrealDB before 2.2.2 Denial of Service via JavaScript Scripting third-party-advisory