Security readout for executives and security teams
Plain-English summary
An authenticated user can submit a crafted SurrealDB query that makes the server allocate excessive memory. The database may slow, crash, or become unavailable, disrupting applications that depend on it. The supplied assessment rates this high severity because exploitation is remote and requires only low privileges, although it does not expose or alter data directly.
Executive priority
Prioritize remediation for production or shared SurrealDB systems because a low-privileged authenticated account could interrupt database availability. Upgrade promptly where service outages would affect customers or critical operations. Investigate memory-related crashes, but do not treat them alone as proof of exploitation.
Technical view
SurrealDB before 2.2.2 does not adequately limit output growth in string::replace when regex patterns are used. A malicious authenticated query can trigger unbounded string allocations, exhaust server memory, and cause denial of service. The supplied CVSS 4.0 score is 7.1, with high availability impact and no stated confidentiality or integrity impact.
Likely exposure
Exposure is most likely where users, applications, or tenants have authenticated network access and can submit SurrealDB queries using string::replace. Internet reachability increases opportunity but is not required. Systems running 2.2.2 or later are outside the described “before 2.2.2” scope.
Exploitation context
The supplied sources do not report active exploitation, and the CVE is not listed as KEV in the bundle. Exploitation requires authentication and query capability but reportedly has low complexity and needs no user interaction. Evidence about public proof-of-concept availability is not provided.
Researcher notes
The weakness maps to CWE-789 and concerns uncontrolled memory allocation during regex-based replacement. The supplied affected-version entries are ambiguously formatted and include multiple thresholds, while the title and description identify versions before 2.2.2. Confirm branch-specific status against the vendor advisory before closing findings.
Mitigation direction
- Upgrade SurrealDB to version 2.2.2 or later, following the vendor advisory.
- Restrict query access to trusted identities and apply least-privilege permissions.
- Limit unnecessary network access to SurrealDB services.
- Monitor database memory consumption, process termination, and unexpected restarts.
- Check vendor guidance for any branch-specific remediation requirements.
Validation and detection
- Inventory every SurrealDB deployment and record its exact installed version.
- Confirm exposed instances require authentication and restrict query-capable accounts.
- Verify upgraded instances report version 2.2.2 or later.
- Review telemetry for abnormal memory growth, out-of-memory events, or repeated restarts.
- Use safe non-production testing to confirm resource controls without reproducing denial of service.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-789: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-71395 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
7.1HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- GitHub Security Advisory (GHSA-3633-g6mg-p6qq)CVE reference, VulnCheck · vendor-advisory
- VulnCheck Advisory: SurrealDB before 2.2.2 Memory Exhaustion via string::replaceCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Memory Allocation with Excessive Size Value
Memory Allocation with Excessive Size Value represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.