Memory Exhaustion in SurrealDB String Replace Function

Executive Summary

CVE-2025-71395 is a memory exhaustion vulnerability in SurrealDB versions before 2.2.2. It occurs in the string::replace function when regex patterns are used. The function fails to limit the resulting string length, allowing an attacker to craft malicious queries that cause unbounded memory allocation. This leads to server memory exhaustion and denial of service.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor SurrealDB server logs for excessive memory usage or crashes during query processing. Check for queries using the string::replace function with regex patterns. Use system monitoring tools like 'top', 'htop', or 'ps' to observe memory consumption spikes. Ensure SurrealDB versions are updated to 2.2.2 or later.

Useful 0 Not Useful 0

Impact Analysis

An authenticated attacker can exploit this to crash the SurrealDB server by causing memory exhaustion. This results in downtime and loss of service availability for users relying on the database. Systems with high query volumes are particularly vulnerable.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts system availability by causing memory exhaustion and potential server crashes, which could lead to service disruptions. For compliance standards like GDPR and HIPAA, which require data availability and integrity, such disruptions may violate availability requirements. However, the vulnerability itself does not directly expose or leak data, so confidentiality impacts are minimal.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update SurrealDB to version 2.2.2 or later. If updating is not possible, restrict access to the string::replace function using the --deny-functions flag or set SURREAL_CAPS_DENY_FUNC environment variable. Limit user access to authenticated sessions only and monitor server memory usage closely.

Useful 0 Not Useful 0