CVE-2025-71395

Katalog CVE

CVSS 6.5 · Medium EPSS 0,45%

Kerentanan Memory Allocation with Excessive Size Value pada surrealdb. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

SurrealDB versions before 2.2.2 contain a memory exhaustion vulnerability in the string::replace function that fails to restrict resulting string length when using regex patterns. An authenticated attacker can craft a malicious query to exhaust server memory through unbounded string allocations, causing denial of service.

Rincian

Terbit di NVD

18 Juli 2026

Terakhir diubah

29 September 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-789: Memory Allocation with Excessive Size Value

EPSS (30 hari)

0,45% peluang dieksploitasi; lebih tinggi dari 37,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-3633-g6mg-p6qq advisory vendor
• https://www.vulncheck.com/advisories/surrealdb-before-memory-exhaustion-via-string-replace advisory pihak ketiga