CVE-2025-71397: SurrealDB DOS Vulnerability

CVE-2025-71397 Overview

CVE-2025-71397 is a CPU exhaustion vulnerability in SurrealDB, a multi-model database platform. Authenticated users with OWNER or EDITOR permissions at the root, namespace, or database level can define custom database functions using DEFINE FUNCTION that contain nested FOR loops. While SurrealDB caps iteration counts for a single loop, it does not enforce limits on the total iteration count produced by nesting multiple loops together.

An attacker can execute a crafted function that consumes all available server CPU time. Configured query timeouts fail to interrupt execution, leaving the server unresponsive to other queries and connections until a manual restart. The flaw is tracked under CWE-835: Loop with Unreachable Exit Condition.

Critical Impact
A single authenticated user can render the SurrealDB instance unresponsive to all queries and connections until an operator manually restarts the service.

Affected Products

SurrealDB versions before 2.0.5
SurrealDB 2.1.x before 2.1.5
SurrealDB 2.2.x before 2.2.2

Discovery Timeline

2026-07-18 - CVE-2025-71397 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2025-71397

Vulnerability Analysis

SurrealDB supports user-defined functions through the DEFINE FUNCTION statement in its SurrealQL query language. These functions can include control flow constructs such as FOR loops for iterating over ranges or arrays. The database engine enforces an upper bound on the iteration count of an individual FOR loop to prevent runaway execution.

The iteration limit only applies per loop, not to the cumulative product of nested loop iterations. When an attacker nests two or more loops, each near the individual iteration cap, the effective iteration count becomes the multiplicative product. For example, two nested loops of 1,000,000 iterations each produce 1,000,000,000,000 total iterations.

The query engine's timeout enforcement fails to interrupt execution inside these tight computational loops. The affected server thread saturates CPU capacity, and because SurrealDB shares CPU resources across query handlers, all concurrent and subsequent queries stall. Only a manual restart restores service.

Root Cause

The root cause is missing global resource accounting for compound control flow. The engine validates each FOR construct in isolation rather than tracking cumulative iteration budget or wall-clock time across nested scopes. Combined with unresponsive timeout handling inside compute-bound execution paths, the design permits a single query to monopolize the server.

Attack Vector

Exploitation requires network access to the SurrealDB endpoint and valid credentials with OWNER or EDITOR privileges at the root, namespace, or database scope. The attacker issues a DEFINE FUNCTION statement containing nested FOR loops, then invokes the function. No further interaction is required. The attack does not compromise confidentiality or integrity but produces complete availability loss for the database service.

A representative attack pattern involves defining a custom function whose body contains at least two nested FOR loops, each iterating over a range near the per-loop maximum, and then calling that function to trigger sustained CPU saturation. Refer to the SurrealDB GitHub Security Advisory GHSA-pxw4-94j3-v9pf for authoritative technical details.

Detection Methods for CVE-2025-71397

Indicators of Compromise

Sustained 100% CPU utilization on the SurrealDB host process without a corresponding increase in query throughput.
SurrealDB instance stops responding to new client connections or health checks while the process remains running.
Audit log entries showing recent DEFINE FUNCTION statements from non-administrative accounts, particularly those containing multiple FOR keywords.
Query execution durations that exceed configured timeout values without the query being terminated.

Detection Strategies

Parse SurrealDB query logs for DEFINE FUNCTION statements and inspect function bodies for nested FOR constructs.
Alert on custom function invocations that continue executing beyond the configured statement timeout.
Correlate authentication events for OWNER and EDITOR role sessions with subsequent schema modification activity.

Monitoring Recommendations

Track CPU utilization per SurrealDB process and generate alerts when sustained saturation coincides with a single active query.
Monitor the count and identity of accounts holding OWNER or EDITOR permissions and review deviations.
Baseline normal query duration and volume to detect availability degradation before full outage.

How to Mitigate CVE-2025-71397

Immediate Actions Required

Upgrade SurrealDB to 2.0.5, 2.1.5, 2.2.2, or later according to the deployed branch.
Audit all accounts with OWNER or EDITOR permissions at root, namespace, and database scope, and revoke any not required for operations.
Review existing user-defined functions for nested FOR loops and remove or refactor suspicious definitions.

Patch Information

The SurrealDB maintainers released fixed builds in versions 2.0.5, 2.1.5, and 2.2.2. Operators should upgrade to the patched release matching their current major version. Details are published in the SurrealDB GitHub Security Advisory and the VulnCheck Advisory on SurrealDB.

Workarounds

Restrict DEFINE FUNCTION privileges by limiting OWNER and EDITOR role assignments to trusted administrators only.
Place SurrealDB behind a network segmentation boundary so that only application-layer service accounts can reach it.
Deploy SurrealDB with per-process CPU quotas using cgroups or container resource limits to contain the blast radius of a runaway query.
Establish an operational runbook to detect unresponsive instances and initiate rapid restart to shorten outage duration.

bash

# Example: constrain SurrealDB to 2 CPU cores using systemd to limit blast radius
# /etc/systemd/system/surrealdb.service.d/override.conf
[Service]
CPUQuota=200%
CPUAccounting=true
MemoryAccounting=true