Executive brief
SurrealDB is a multi-model database used for managing and querying large-scale data. A vulnerability in its scripting engine allows an authorized user to bypass safety limits and trigger infinite loops. This can cause the database server to run out of memory and crash, leading to a complete service outage and disrupting business operations.
Technical details
SurrealDB is vulnerable to uncontrolled recursion (CWE-674) in its scripting engine. While the database implements recursion limits for native and JavaScript functions individually, these limits can be bypassed by interleaving native function calls with embedded JavaScript that issues new queries. An authenticated attacker can exploit this by creating a circular chain of calls, leading to infinite recursion that exhausts server memory before the safety limits are triggered. This vulnerability only affects instances where scripting is explicitly enabled (e.g., via --allow-scripting). Patches are available in versions 2.0.5, 2.1.5, and 2.2.2.
Affected products
- SurrealDB SurrealDB < 2.0.5, < 2.1.5, < 2.2.2
Timeline
- 2025-04-10: advisory: Initial GitHub security advisory published
- 2026-07-18: disclosed: NVD publication date