CVE-2025-71393
Description
SurrealDB before 2.2.2 with scripting enabled fails to properly enforce recursion limits when native functions contain embedded JavaScript that issues new queries. Authenticated attackers can bypass the recursion limit by chaining native and JavaScript function calls to trigger infinite recursion and exhaust server memory.
Is your site exposed to CVE-2025-71393?
Run a free security scan — no signup, results in seconds.
Weakness Type (CWE)
References
Frequently Asked Questions
What is CVE-2025-71393? +
How do I check if I'm vulnerable to CVE-2025-71393? +
Related Vulnerabilities
Fixed a VM panic caused by unbounded recursion in the grpcfuse kernel module when a container created deeply nested directories …
When the module renders a Svg file that contains a <pattern> element, it might end up rendering it recursively leading …
In Xpdf 4.05 (and earlier), a PDF object loop in a CMap, via the "UseCMap" entry, leads to infinite recursion …
Kanidm is an identity management platform. Prior to version 1.9.3, a single unauthenticated GET to any /scim/v1/... endpoint with a …
eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well …
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to …