VulnerabilityAnalyzed

CVE-2025-71390

This bypasses network access controls, allowing access to restricted internal endpoints and potentially retrieving or altering sensitive information and credentials, depending on the deployment.

MEDIUM 5.8EPSS 0.25%

Does this matter?

Lower severity and a low EPSS score (0.25%). Track it; it rarely justifies an emergency change on its own.

Description

SurrealDB before 2.2.6, 2.3.6, and 2.1.8 (and 3.0.0-alpha.7 and earlier) fails to validate DNS-resolved hostnames against --deny-net network access restrictions in its http::* functions. An authenticated user can invoke http::<fn>(<url>) with a hostname that resolves to a denied IP address, causing the server to issue the request anyway and return the response. This bypasses network access controls, allowing access to restricted internal endpoints and potentially retrieving or altering sensitive information and credentials, depending on the deployment.

CVSS 4.0: 5.8 MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.25% probability · 16th percentile
CISA KEV: Not listed
Weakness: CWE-863
Affected: surrealdb/surrealdb
Source: disclosure@vulncheck.com

References

https://github.com/surrealdb/surrealdb/security/advisories/GHSA-m3c3-78fh-w3w7Vendor Advisory
https://www.vulncheck.com/advisories/surrealdb-before-deny-net-bypass-via-dns-resolutionThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.