PT-2025-16146 · Crates.Io · Surrealdb

Published 2025-04-11 · Updated 2025-04-11

OSV

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

An authenticated user can craft a query using the string::replace function that uses a Regex to perform a string replacement. As there is a failure to restrict the resulting string length, this enables an attacker to send a string::replace function to the SurrealDB server exhausting all the memory of the server due to string allocations. This eventually results in a Denial-of-Service situation for the SurrealDB server.

This issue was discovered and patched during an code audit and penetration test of SurrealDB by cure53. Using CVSSv4 definitions, the severity is High.

Impact

An authenticated user can crash the SurrealDB instance through memory exhaustion

Patches

A patch has been created that enforces a limit on string length SURREAL GENERATION ALLOCATION LIMIT

• Versions 2.0.5, 2.1.5, 2.2.2, and later are not affected by this issue

Workarounds

Affected users who are unable to update may want to limit the ability of untrusted clients to run the string::replace function in the affected versions of SurrealDB using the --deny-functions flag described within Capabilities or the equivalent SURREAL CAPS DENY FUNC environment variable.

References

SurrealQL Documentation - DB Functions (string::replace) SurrealDB Documentation - Capabilities SurrealDB Documentation - Environment Variables #5619 #5638

Fix

Weakness Enumeration

CWE-789

Related Identifiers

GHSA-3633-G6MG-P6QQ

Affected Products

Surrealdb

References · 5

• https://osv.dev/vulnerability/GHSA-3633-g6mg-p6qq · Vendor Advisory
• https://github.com/surrealdb/surrealdb · Note
• https://github.com/surrealdb/surrealdb/pull/5619 · Note
• https://github.com/surrealdb/surrealdb/pull/5638 · Note
• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-3633-g6mg-p6qq · Note