SurrealDB Scripting Function DoS via Default Timeout (GHSA-3824-qmfg-2qv7) Advisory

Vulnerability Overview Vulnerability Title: No JavaScript script function default timeout could facilitate DoS Vulnerability ID: GHSA-3824-qmfg-2qv7 Publication Date: April 10, 2025 Severity: Low (CVSS v4 base metrics: 2.3/10) Attack Vector: Network Attack Complexity: Low Attack Requirements: Present Privileges Required: Low User Interaction: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Low Scope Affected Versions: - SurrealDB (Rust) < 2.2.2 - SurrealDB (Rust) < 2.0.5 - SurrealDB (Rust) < 2.1.5 Vulnerability Description: - By enabling the scripting feature, SurrealDB allows advanced functions with complex logic, permitting embedded functions to be written in JavaScript. - These functions are constrained in terms of memory and stack size but are not constrained in terms of time. An attacker can initiate multiple long-running functions, which may facilitate a denial-of-service attack. - This vulnerability only affects SurrealDB servers where the scripting feature is explicitly enabled, via or , as well as the equivalent environment variables and . - This issue was discovered during a code audit and penetration test of SurrealDB by cure53. Based on cure53's initial assessment, the severity is defined as Low, which aligns with our CVSS v4 evaluation. Remediation Patch: - A default timeout for script execution has been implemented, configurable via the environment variable. - Versions 2.0.5, 2.1.5, 2.2.2, and later are not affected by this issue. Workaround: - For users unable to upgrade, execution of embedded scripting functions can be disabled by configuring when starting SurrealDB, using the flag or the equivalent environment variable . This has an availability impact, as scripting functions are disabled by default. References GHSA-3824-qmfg-2qv7 SurrealDB Documentation - Capabilities SurrealQL Documentation - Scripting Functions

Goal Reached Thanks to every supporter — we hit 100%!

SurrealDB Scripting Function DoS via Default Timeout (GHSA-3824-qmfg-2qv7) Advisory

More from this source