SurrealDB before 2.3.6 deny-net Bypass via DNS Resolution
Priority LOW 26CWE-863Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.
Summary
SurrealDB before 2.2.6, 2.3.6, and 2.1.8 (and 3.0.0-alpha.7 and earlier) fails to validate DNS-resolved hostnames against --deny-net network access restrictions in its http::* functions. An authenticated user can invoke http::<fn>(<url>) with a hostname that resolves to a denied IP address, causing the server to issue the request anyway and return the response. This bypasses network access controls, allowing access to restricted internal endpoints and potentially retrieving or altering sensitive information and credentials, depending on the deployment.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00451 39th percentileScored 2026-11-07
Fix Fixed surrealdb (surrealdb): 2.2.6, 2.3.6SurrealDB (crates.io): 2.1.8, 2.2.6, 3.0.0-alpha.7 +1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| surrealdb | surrealdb | up to 2.1.7; 2.2.0 to before 2.2.6; 2.3.0 to before 2.3.6; 3.0.0-alpha.1 – 3.0.0-alpha.7 | 2.2.6, 2.3.6 | Patch available | CNA |
| — | SurrealDB (crates.io) | 2.1.0 to before 2.1.8 | 2.1.8 | Patch available | GHSA-m3c3-78fh-w3w7 |
| — | SurrealDB (crates.io) | 2.2.0 to before 2.2.6 | 2.2.6 | Patch available | GHSA-m3c3-78fh-w3w7 |
| — | SurrealDB (crates.io) | 3.0.0-alpha.1 to before 3.0.0-alpha.7 | 3.0.0-alpha.7 | Patch available | GHSA-m3c3-78fh-w3w7 |
| — | SurrealDB (crates.io) | 2.3.0 to before 2.3.6 | 2.3.6 | Patch available | GHSA-m3c3-78fh-w3w7 |
- surrealdb Vendorsurrealdb Affected up to 2.1.7; 2.2.0 to before 2.2.6; 2.3.0 to before 2.3.6; 3.0.0-alpha.1 – 3.0.0-alpha.7 Fixed in 2.2.6, 2.3.6 Patch available CNA
- SurrealDB (crates.io) Vendor— Affected 2.1.0 to before 2.1.8 Fixed in 2.1.8 Patch available GHSA-m3c3-78fh-w3w7
- SurrealDB (crates.io) Vendor— Affected 2.2.0 to before 2.2.6 Fixed in 2.2.6 Patch available GHSA-m3c3-78fh-w3w7
- SurrealDB (crates.io) Vendor— Affected 3.0.0-alpha.1 to before 3.0.0-alpha.7 Fixed in 3.0.0-alpha.7 Patch available GHSA-m3c3-78fh-w3w7
- SurrealDB (crates.io) Vendor— Affected 2.3.0 to before 2.3.6 Fixed in 2.3.6 Patch available GHSA-m3c3-78fh-w3w7
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:* | before 2.1.8; 2.2.0 to before 2.2.6; 2.3.0 to before 2.3.6 | Vulnerable | surrealdb |
| cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha1:*:*:*:*:*:* | 3.0.0 alpha1 | Vulnerable | surrealdb |
| cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha2:*:*:*:*:*:* | 3.0.0 alpha2 | Vulnerable | surrealdb |
| cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha3:*:*:*:*:*:* | 3.0.0 alpha3 | Vulnerable | surrealdb |
| cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha4:*:*:*:*:*:* | 3.0.0 alpha4 | Vulnerable | surrealdb |
| cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha5:*:*:*:*:*:* | 3.0.0 alpha5 | Vulnerable | surrealdb |
| cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha6:*:*:*:*:*:* | 3.0.0 alpha6 | Vulnerable | surrealdb |
| cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha7:*:*:*:*:*:* | 3.0.0 alpha7 | Vulnerable | surrealdb |
- cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:* Versions before 2.1.8; 2.2.0 to before 2.2.6; 2.3.0 to before 2.3.6 Vulnerable ·surrealdb
- cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha1:*:*:*:*:*:* Versions 3.0.0 alpha1 Vulnerable ·surrealdb
- cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha2:*:*:*:*:*:* Versions 3.0.0 alpha2 Vulnerable ·surrealdb
- cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha3:*:*:*:*:*:* Versions 3.0.0 alpha3 Vulnerable ·surrealdb
- cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha4:*:*:*:*:*:* Versions 3.0.0 alpha4 Vulnerable ·surrealdb
- cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha5:*:*:*:*:*:* Versions 3.0.0 alpha5 Vulnerable ·surrealdb
- cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha6:*:*:*:*:*:* Versions 3.0.0 alpha6 Vulnerable ·surrealdb
- cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha7:*:*:*:*:*:* Versions 3.0.0 alpha7 Vulnerable ·surrealdb
Remediation
- Fix · CNA surrealdb (surrealdb) Fixed in 2.2.6, 2.3.6
- Fix · GHSA-m3c3-78fh-w3w7 SurrealDB (crates.io) Fixed in 2.1.8 Advisory →
- Fix · GHSA-m3c3-78fh-w3w7 SurrealDB (crates.io) Fixed in 2.2.6 Advisory →
- Fix · GHSA-m3c3-78fh-w3w7 SurrealDB (crates.io) Fixed in 3.0.0-alpha.7 Advisory →
- Fix · GHSA-m3c3-78fh-w3w7 SurrealDB (crates.io) Fixed in 2.3.6 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-71390
- 2026-10-03 Alias added: GHSA-m3c3-78fh-w3w7
References
Advisory 2
Other 9
- https://github.com/surrealdb/surrealdb/pull/6101
- https://github.com/surrealdb/surrealdb/pull/6119
- https://github.com/surrealdb/surrealdb/pull/6120
- https://github.com/surrealdb/surrealdb/pull/6121
- https://github.com/surrealdb/surrealdb/commit/4b317d850c7dabaee228144423741097232f7955
- https://github.com/surrealdb/surrealdb/commit/7c574dfa90211923e2ff1b12510c8479f8805b3d
- https://github.com/surrealdb/surrealdb/commit/b80d7d08b043c0e4bc0b7ff8ddb9be0907c0bf59
- https://github.com/surrealdb/surrealdb/commit/d5dc46f1c255ed450b3af025a0bdc165b6ce54a3
- https://github.com/surrealdb/surrealdb
More Surrealdb vulnerabilities
- TI-2026-45344 SurrealDB before 3.1.0 Session Hijacking via /rpc sessions CVSS 4.0HIGH 8.7
- TI-2024-38452 SurrealDB before 1.1.0 Denial of Service via HTTP Headers CVSS 4.0HIGH 8.7
- TI-2026-45347 SurrealDB before 3.1.0 Denial of Service via JSON Parser CVSS 4.0HIGH 8.7
- TI-2026-45334 SurrealDB before 3.1.0 Denial of Service via malformed RPC use CVSS 4.0HIGH 8.7
- TI-2025-43508 SurrealDB before 2.2.2 SurrealQL Injection via export CVSS 4.0CRITICAL 9.4
- TI-2026-45343 SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Condition CVSS 4.0CRITICAL 9.2
Sources
- CVE-2025-71390 · CVE Program
- CVE-2025-71390 · NVD
- FIRST EPSS
- GHSA-m3c3-78fh-w3w7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences