Executive brief
SurrealDB, a multi-model cloud database, is vulnerable to a denial-of-service attack that can completely freeze the server. An authorized user with permission to create functions can use nested loops to exhaust the server's CPU resources. This causes the database to stop responding to all other users and queries, requiring a manual restart to restore service.
Technical details
A vulnerability in the SurrealQL parser and interpreter allows for CPU exhaustion via the DEFINE FUNCTION statement. While individual FOR loops have iteration constraints, the engine fails to limit the cumulative iterations of nested loops. An attacker with OWNER or EDITOR privileges can define and execute a function with multiple nested loops (e.g., several levels of 1,000,000 iterations), which bypasses configured execution timeouts. This results in 100% CPU utilization, preventing the server from processing other queries or accepting new connections. The issue is resolved in versions 2.0.5, 2.1.5, and 2.2.2 by adding context cancellation and timeout checks within each loop iteration.
Affected products
- SurrealDB SurrealDB < 2.0.5, 2.1.x < 2.1.5, 2.2.x < 2.2.2
Timeline
- 2025-04-10: advisory: Vendor advisory published via GitHub
- 2026-07-18: disclosed: NVD publication date