Is CVE-2025-71395 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-71395 being exploited in the wild.

How severe is CVE-2025-71395?

Medium severity, with a CVSS score of 4, published 18 July 2026.

Which products and versions are affected?

surrealdb (crates.io) SEMVER:introduced=2.2.0,fixed=2.2.2.

Is there a fix for CVE-2025-71395?

Yes. surrealdb (crates.io): upgrade to 2.2.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-71395 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2025-71395?

Check whether you run surrealdb (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-71395: SurrealDB memory exhaustion in string::replace function

CVE-2025-71395 · Severity: medium · CVSS 4 · Published 2026-07-18

SurrealDB is a multi-model database used for managing and querying large-scale data. A vulnerability in its string processing functions allows a logged-in user to crash the database server by running a specially crafted search-and-replace command. This results in a total service outage, preventing all users and applications from accessing the database until it is restarted.

Technologies: surrealdb (crates.io). Vendors: crates.io.

Quick answers

Is CVE-2025-71395 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-71395 being exploited in the wild.
How severe is CVE-2025-71395?: Medium severity, with a CVSS score of 4, published 18 July 2026.
Which products and versions are affected?: surrealdb (crates.io) SEMVER:introduced=2.2.0,fixed=2.2.2.
Is there a fix for CVE-2025-71395?: Yes. surrealdb (crates.io): upgrade to 2.2.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-71395 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2025-71395?: Check whether you run surrealdb (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

surrealdb (crates.io): upgrade to 2.2.2 or later
```
cargo update -p surrealdb
```

Technical details

A memory exhaustion vulnerability (CWE-789) exists in SurrealDB's 'string::replace' function when processing regular expressions. The root cause is a failure to enforce limits on the length of the resulting string during regex-based replacement operations. An authenticated attacker with network access can execute a malicious SurrealQL query that triggers unbounded memory allocations. This leads to a crash of the SurrealDB instance due to Out-Of-Memory (OOM) conditions. The issue has been patched in versions 2.0.5, 2.1.5, and 2.2.2 by introducing the 'SURREAL_GENERATION_ALLOCATION_LIMIT' to enforce string length constraints.

Affected products

SurrealDB SurrealDB < 2.0.5, < 2.1.5, < 2.2.2

Identifiers

CVE-2025-71395
GHSA-3633-g6mg-p6qq

Timeline

2025-04-10: advisory: GitHub Security Advisory published
2026-07-18: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.