Advisoriesby IbisSurrealDB memory exhaustion via string::replace using regex
An authenticated user can craft a query using the string::replace function that uses a Regex to perform a string replacement. As there is a failure to restrict the resulting string length, this enables an attacker to send a string::replace function to the SurrealDB server exhausting all the memory of the server due to string allocations. This eventually results in a Denial-of-Service situation for the SurrealDB server.
This issue was discovered and patched during an code audit and penetration test of SurrealDB by cure53. Using CVSSv4 definitions, the severity is High.
Impact
An authenticated user can crash the SurrealDB instance through memory exhaustion
Patches
A patch has been created that enforces a limit on string length SURREAL_GENERATION_ALLOCATION_LIMIT
- Versions 2.0.5, 2.1.5, 2.2.2, and later are not affected by this issue
Workarounds
Affected users who are unable to update may want to limit the ability of untrusted clients to run the string::replace function in the affected versions of SurrealDB using the --deny-functions flag described within [Capabilities](https://surrealdb.com/docs/surrealdb/security/capabilities#functions) or the equivalent SURREAL_CAPS_DENY_FUNC environment variable.
References
[SurrealQL Documentation - DB Functions...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| surrealdb crates.io | >= 2.2.0, < 2.2.2 | 2.2.2 |
| >= 2.1.0, < 2.1.5 | 2.1.5 | |
| < 2.0.5 | 2.0.5 |
Details and references
An authenticated user can craft a query using the `string::replace` function that uses a Regex to perform a string replacement. As there is a failure to restrict the resulting string length, this enables an attacker to send a `string::replace` function to the SurrealDB server exhausting all the memory of the server due to string allocations. This eventually results in a Denial-of-Service situation for the SurrealDB server. This issue was discovered and patched during an code audit and penetration test of SurrealDB by cure53. Using CVSSv4 definitions, the severity is High. ### Impact An authenticated user can crash the SurrealDB instance through memory exhaustion ### Patches A patch has been created that enforces a limit on string length `SURREAL_GENERATION_ALLOCATION_LIMIT` - Versions 2.0.5, 2.1.5, 2.2.2, and later are not affected by this issue ### Workarounds Affected users who are unable to update may want to limit the ability of untrusted clients to run the `string::replace` function in the affected versions of SurrealDB using the `--deny-functions` flag described within [Capabilities](https://surrealdb.com/docs/surrealdb/security/capabilities#functions) or the equivalent `SURREAL_CAPS_DENY_FUNC` environment variable. ### References [SurrealQL Documentation - DB Functions (string::replace)](https://surrealdb.com/docs/surrealql/functions/database/string#stringreplace) [SurrealDB Documentation - Capabilities](https://surrealdb.com/docs/surrealdb/security/capabilities#functions) [SurrealDB Documentation - Environment Variables](https://surrealdb.com/docs/surrealdb/cli/env) [#5619 ](https://github.com/surrealdb/surrealdb/pull/5619) [#5638 ](https://github.com/surrealdb/surrealdb/pull/5638)
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-789
- Also known as
- CVE-2025-71395
More SurrealDB advisories
All SurrealDB
SurrealDB bypass of deny-net flags via redirect results in server-side request forgery (SSRF)CVE-2025-71398fixed in 2.0.5 +2SurrealDB CPU exhaustion via custom functions result in total DoSCVE-2025-71397fixed in 2.0.5 +2SurrealDB no JavaScript script function default timeout could facilitate DoSCVE-2025-71396fixed in 2.0.5 +2SurrealDB server-takeover via SurrealQL injection on backup importCVE-2025-71392fixed in 2.0.5 +2SurrealDB has local file read of 2-column TSV files via analyzersCVE-2025-71394fixed in 2.1.5 +1SurrealDB vulnerable to memory exhaustion via nested functions and scriptsCVE-2025-71393fixed in 2.0.5 +2