Memory Exhaustion Vulnerability in SurrealDB by SurrealDB

CVE-2025-71395

What is CVE-2025-71395?

SurrealDB versions prior to 2.2.2 are vulnerable to a memory exhaustion issue due to improper handling of string length in the string::replace function. This flaw allows authenticated attackers to craft queries that exploit regex patterns, leading to unbounded string allocations. As a result, server memory can be exhausted, potentially causing a denial of service. Organizations using affected versions should promptly update to mitigate this vulnerability.

References