CVE-2025-71398: SurrealDB SSRF via HTTP redirect bypass in http functions

CVE-2025-71398 · Severity: medium · CVSS 4 · Published 2026-07-18

SurrealDB is a database platform that provides HTTP functions to access external network endpoints. A critical security feature called "deny-net" allows administrators to block requests to specific IP ranges (e.g., internal or private networks). This vulnerability allows an authenticated database user to bypass these network restrictions by hosting a malicious server that redirects HTTP requests to blocked addresses. An attacker can retrieve sensitive data from internal services that are normally unreachable, such as AWS metadata endpoints, potentially exposing credentials and other confidential information.

Technologies: surrealdb (crates.io). Vendors: crates.io.

Quick answers

Is CVE-2025-71398 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-71398 being exploited in the wild.
How severe is CVE-2025-71398?
Medium severity, with a CVSS score of 4, published 18 July 2026.
Which products and versions are affected?
surrealdb (crates.io) SEMVER:introduced=2.2.0,fixed=2.2.2.
Is there a fix for CVE-2025-71398?
Yes. surrealdb (crates.io): upgrade to 2.2.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-71398 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-71398?
Check whether you run surrealdb (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • surrealdb (crates.io): upgrade to 2.2.2 or later
    cargo update -p surrealdb

Technical details

This is a server-side request forgery (SSRF) vulnerability (CWE-918) in SurrealDB's HTTP functions. The vulnerability stems from insufficient validation of HTTP redirects when accessing external endpoints. An authenticated attacker can chain HTTP 301/307 redirects from an attacker-controlled server to reach IP addresses that the administrator has explicitly blocked via the --deny-net flag. Because SurrealDB follows these redirects and returns response data to the attacker, this results in a full SSRF attack. The vulnerability affects versions before 2.0.5, 2.1.0-2.1.4, and 2.2.0-2.2.1. The fix adds HTTP redirect limits and validates redirects against the network allowlist to prevent redirections to disallowed URIs. Authentication is required to exploit this issue, and the attacker must be able to host a server on the public internet.

Affected products

  • SurrealDB SurrealDB < 2.0.5, >= 2.1.0 and < 2.1.5, >= 2.2.0 and < 2.2.2

Identifiers

  • CVE-2025-71398
  • GHSA-5q9x-554g-9jgg

Timeline

  • 2025-04-10: disclosed: Vulnerability disclosed by Cure53 during security audit and penetration test
  • 2025-04-11: patched: Patches released: versions 2.0.5, 2.1.5, 2.2.2 and later
  • 2025-04-11: advisory: GitHub Advisory GHSA-5q9x-554g-9jgg published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.