CVE-2025-71391

MediumCVSS 6.5/10Last modified Sep 29, 2026

Description

SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module that allows authenticated users to crash the database. Attackers can send crafted HTTP queries containing null bytes to the /sql endpoint, causing an unhandled exception that crashes the SurrealDB instance and any dependent applications.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-248

Affected software

No affected versions have been published.

Timeline

Published: Jul 18, 2026
Last modified: Sep 29, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-713928.0SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export CVE-2025-713936.5SurrealDB before 2.2.2 with scripting enabled fails to properly enforce recursion limits when native functions contain embedded JavaScript t CVE-2025-713944.3SurrealDB versions before 2.2.2 contain a local file read vulnerability in the DEFINE ANALYZER statement that allows authenticated users to CVE-2025-713956.5SurrealDB versions before 2.2.2 contain a memory exhaustion vulnerability in the string::replace function that fails to restrict resulting s CVE-2025-713966.5SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 does not enforce a default execution-time limit on embedded JavaScript sc CVE-2025-713976.5SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 allows authenticated users with OWNER or EDITOR permissions (at the root,CVE-2025-713987.6SurrealDB before 2.2.2 fails to validate HTTP redirects in http functions, allowing authenticated users to bypass deny-net restrictions by r CVE-2025-713998.6Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3, paths are normalized by removing empty CVE-2025-71405.4A vulnerability classified as problematic has been found in SourceCodester Best Salon Management System 1.0. Affected is an unknown function CVE-2025-714007.1better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint that al CVE-2025-714015.9better-auth (npm) before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined (e.g., BETTER_AUTH_URL is un CVE-2025-714022.0better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook, which