CVE-2025-71391: SurrealDB DOS Vulnerability via Net Module

CVE-2025-71391 Overview

CVE-2025-71391 is a denial-of-service vulnerability in SurrealDB versions before 2.2.2. The flaw resides in the net module and stems from an uncaught exception [CWE-248] when the server processes malformed HTTP input. Authenticated users can send crafted HTTP requests containing null bytes to the /sql endpoint, triggering an unhandled exception that terminates the SurrealDB process. Any application depending on the database instance loses availability until the service is restarted.

Critical Impact
An authenticated attacker with minimal privileges can crash a SurrealDB instance remotely by submitting a single crafted HTTP query, disrupting all dependent services.

Affected Products

SurrealDB versions prior to 2.2.2
Applications embedding vulnerable SurrealDB releases as a backend
Deployments exposing the /sql HTTP endpoint to authenticated clients

Discovery Timeline

2026-07-18 - CVE-2025-71391 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2025-71391

Vulnerability Analysis

The vulnerability is classified as an Uncaught Exception weakness [CWE-248] in the SurrealDB net module. The /sql endpoint accepts SQL statements over HTTP for authenticated users. When the request body contains null bytes embedded in the query, the parsing path raises an exception that no handler catches. The exception propagates up the request-handling stack and terminates the SurrealDB process rather than returning a controlled error response.

Because SurrealDB frequently runs as a single-process backend for downstream applications, the crash cascades. Web services, APIs, and worker jobs relying on the instance lose their data layer immediately. The impact is availability-only, with no confidentiality or integrity effects, consistent with the CVSS 4.0 vector reporting high impact on availability alone.

Root Cause

The root cause is missing input validation and missing exception handling in the HTTP query parser inside the net module. Null bytes are treated as illegal characters by the underlying string handling routines, but the error path does not sanitize input before parsing and does not wrap the fallible operation in a recovery block. Any request that reaches the parser with a null byte in the payload becomes fatal to the process.

Attack Vector

Exploitation requires network access to the SurrealDB HTTP interface and valid credentials with permission to submit queries. The attacker issues an HTTP POST to the /sql endpoint containing a query body with one or more embedded null bytes (\\x00). The server begins parsing the query, raises an unhandled exception, and exits. No memory corruption, code execution, or data disclosure occurs. See the GitHub Security Advisory and the VulnCheck Advisory on SurrealDB for maintainer-provided technical details.

Detection Methods for CVE-2025-71391

Indicators of Compromise

Unexpected SurrealDB process termination or restart events in service supervisor logs (systemd, Kubernetes, Docker)
HTTP POST requests to the /sql endpoint containing null byte characters (\\x00) in the request body
Correlated 5xx errors or connection resets from downstream applications immediately following a request to /sql
Repeated authenticated queries from a single source followed by service unavailability

Detection Strategies

Inspect HTTP request bodies destined for the /sql endpoint for embedded null bytes at the reverse proxy or web application firewall layer
Alert on abnormal SurrealDB exit codes and crash-restart loops within short time windows
Correlate authentication logs with process termination events to identify the account submitting crash-inducing requests

Monitoring Recommendations

Enable verbose access logging on SurrealDB HTTP endpoints and forward to a centralized log platform for query inspection
Track process uptime and restart frequency as a key operational health metric
Monitor per-user query error rates and unusual payloads targeting /sql

How to Mitigate CVE-2025-71391

Immediate Actions Required

Upgrade all SurrealDB instances to version 2.2.2 or later
Restrict network exposure of the SurrealDB HTTP interface to trusted application servers only
Audit existing SurrealDB user accounts and remove or scope down any unnecessary query permissions
Deploy a reverse proxy or WAF rule that rejects HTTP request bodies containing null bytes before they reach SurrealDB

Patch Information

SurrealDB 2.2.2 contains the fix for CVE-2025-71391. The patch adds validation and exception handling in the net module so that malformed input to /sql returns a controlled error instead of crashing the process. Refer to the GitHub Security Advisory for the full advisory and release notes.

Workarounds

Filter or reject requests containing null bytes at an upstream proxy such as NGINX, HAProxy, or a WAF
Place SurrealDB behind an authenticated application gateway that sanitizes SQL payloads before forwarding
Configure an automatic restart policy (systemd Restart=always or Kubernetes liveness probe) to reduce downtime while patching is scheduled
Limit /sql endpoint access via network policy to specific application service accounts and source IPs

bash

# Configuration example: NGINX rule to reject requests with null bytes in the body
http {
    map $request_body $has_null_byte {
        default 0;
        "~\\x00" 1;
    }

    server {
        listen 8000;
        location /sql {
            if ($has_null_byte) {
                return 400 "Invalid request";
            }
            proxy_pass http://surrealdb_backend;
        }
    }
}