Security readout for executives and security teams
Plain-English summary
SurrealDB can be made unavailable when JavaScript scripting is deliberately enabled. An authenticated user may run a long-lived script that consumes server resources because affected releases lack a default execution-time limit. Scripting is disabled by default, substantially limiting ordinary exposure.
Executive priority
Treat this as a routine but time-bound availability fix. Prioritize internet-reachable or business-critical databases running affected versions with scripting enabled and accessible to less-trusted users. Lower the priority for systems where scripting remains disabled, while still confirming configuration and version inventory.
Technical view
CVE-2025-71396 is a CWE-770 resource-exhaustion flaw affecting SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2. It requires network access, authentication, and scripting enabled through --allow-scripting or --allow-all. CVSS 4.0 is 2.3, with availability impact only.
Likely exposure
Exposure is limited to affected SurrealDB versions where scripting was explicitly enabled. Risk increases when untrusted or broadly privileged authenticated users can submit scripting functions. Installations retaining the default scripting-disabled configuration are not exposed through the described condition.
Exploitation context
The supplied sources do not establish active exploitation, and this CVE is not identified as KEV. Exploitation requires an authenticated attacker and a non-default scripting configuration. A successful attack could exhaust resources and interrupt database availability, without documented confidentiality or integrity impact.
Researcher notes
The explicit affected ranges come from the supplied description. The bundle's structured affected entries are ambiguous because they show broad version endpoints while marking the default status unaffected. Validate exact product status against the vendor advisory. No exploit code, observed attacks, or broader security impact is established by the supplied evidence.
Mitigation direction
- Upgrade to SurrealDB 2.0.5, 2.1.5, 2.2.2, or an appropriate later supported release.
- Disable JavaScript scripting unless it is operationally required.
- Avoid --allow-all where narrower capabilities meet operational requirements.
- Restrict scripting access to trusted, least-privileged authenticated identities.
- Review the vendor advisory before applying changes in production.
Validation and detection
- Inventory SurrealDB versions across production, staging, and development systems.
- Check startup arguments and configuration for --allow-scripting or --allow-all.
- Confirm which authenticated identities can submit JavaScript scripting functions.
- Review monitoring for prolonged scripting activity, resource saturation, and unexplained service interruptions.
- After remediation, confirm the deployed version and intended scripting configuration.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-770: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-71396 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Low
- CVSS
- 2.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
2.3LowVector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- GitHub Security Advisory (GHSA-3824-qmfq-2qv7)CVE reference, VulnCheck · vendor-advisory
- VulnCheck Advisory: SurrealDB before 2.2.2 Denial of Service via JavaScript ScriptingCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.