CVE-2025-71395 Overview
CVE-2025-71395 is a memory exhaustion vulnerability in SurrealDB versions before 2.2.2. The flaw resides in the string::replace function, which fails to restrict the length of the resulting string when regex patterns are used. An authenticated attacker can craft a malicious query that triggers unbounded string allocations, exhausting server memory and causing denial of service. The weakness is categorized under [CWE-789] (Memory Allocation with Excessive Size Value). SurrealDB is a multi-model cloud-ready database used for real-time applications, making database availability critical to dependent services.
Critical Impact
An authenticated attacker can crash SurrealDB instances by submitting a single crafted query that consumes all available server memory.
Affected Products
- SurrealDB versions prior to 2.2.2
- Deployments exposing the query interface to authenticated users
- Applications embedding SurrealDB as a backend datastore
Discovery Timeline
- 2026-07-18 - CVE-2025-71395 published to the National Vulnerability Database (NVD)
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2025-71395
Vulnerability Analysis
The vulnerability affects the string::replace function inside SurrealDB's query engine. When the function is invoked with a regex pattern, the implementation does not enforce an upper bound on the size of the output buffer. An attacker with authenticated access can supply inputs where each match expands to a large replacement string, producing exponential or linear-but-uncapped growth in memory usage.
The query executes within the database process, so allocations occur in server-side memory. A single query is sufficient to consume gigabytes of RAM, triggering out-of-memory conditions on the host. The result is service unavailability for all tenants sharing the affected node.
Root Cause
The root cause is missing length validation in the string::replace code path when handling regex-based substitutions. The function allocates memory proportional to the number of matches multiplied by replacement length, without checking against a maximum allowed size. This maps directly to [CWE-789], where the allocation size is influenced by attacker-controlled input.
Attack Vector
Exploitation requires network access to the SurrealDB query endpoint and valid credentials with permission to execute SurrealQL queries. The attacker submits a query that calls string::replace with a regex pattern that matches many times against a moderately sized input, combined with a replacement string large enough to force excessive allocation. No user interaction is required. The attack complexity is low because the payload is a standard SurrealQL statement. The vulnerability mechanism is described in the GitHub Security Advisory GHSA-3633-g6mg-p6qq and the VulnCheck Advisory on SurrealDB.
Detection Methods for CVE-2025-71395
Indicators of Compromise
- Sudden growth in resident memory usage of the surreal server process without a corresponding increase in query volume
- Out-of-memory kills (OOM) recorded in kernel logs for the SurrealDB process
- SurrealQL query logs containing string::replace calls with regex arguments and unusually long replacement strings
- Repeated crashes or restarts of the SurrealDB service correlated with authenticated user sessions
Detection Strategies
- Enable query logging on SurrealDB and alert on invocations of string::replace where input or replacement string length exceeds an expected threshold
- Monitor process-level memory metrics and set alerts on rapid allocation spikes for the database process
- Correlate authenticated session identifiers with anomalous query patterns to identify the originating account
Monitoring Recommendations
- Ship SurrealDB logs and host metrics to a centralized analytics platform for anomaly detection
- Track OOM events at the kernel and container orchestrator level (for example, Kubernetes pod evictions with reason OOMKilled)
- Baseline normal query duration and memory footprint, then alert on statistical outliers
How to Mitigate CVE-2025-71395
Immediate Actions Required
- Upgrade SurrealDB to version 2.2.2 or later on all nodes
- Audit which authenticated principals hold query execution privileges and revoke access from accounts that do not require it
- Review recent query logs for suspicious string::replace usage predating the patch
Patch Information
SurrealDB 2.2.2 remediates the issue by restricting the length of the string returned by string::replace when regex patterns are used. Refer to the GitHub Security Advisory GHSA-3633-g6mg-p6qq for the fix commit and release notes.
Workarounds
- Restrict database credentials so only trusted services can execute arbitrary SurrealQL queries
- Place SurrealDB behind an application layer that validates and sanitizes user-supplied query fragments before submission
- Enforce per-process memory limits using cgroups, systemdMemoryMax, or container resource constraints to contain the blast radius
# Configuration example: apply a memory limit to the SurrealDB systemd unit
# /etc/systemd/system/surrealdb.service.d/override.conf
[Service]
MemoryMax=4G
MemoryHigh=3G
Restart=on-failure
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
