VulnerabilityAnalyzed

CVE-2025-71398

SurrealDB before 2.2.2 fails to validate HTTP redirects in http functions, allowing authenticated users to bypass deny-net restrictions by redirecting to blocked IP addresses.

MEDIUM 5.8EPSS 0.19%

Does this matter?

Lower severity and a low EPSS score (0.19%). Track it; it rarely justifies an emergency change on its own.

Description

SurrealDB before 2.2.2 fails to validate HTTP redirects in http functions, allowing authenticated users to bypass deny-net restrictions by redirecting to blocked IP addresses. Attackers can host a public server that redirects to denied network targets, enabling server-side request forgery to access internal endpoints and retrieve sensitive information.

CVSS 4.0: 5.8 MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.19% probability · 9th percentile
CISA KEV: Not listed
Weakness: CWE-918
Affected: surrealdb/surrealdb
Source: disclosure@vulncheck.com

References

https://github.com/surrealdb/surrealdb/security/advisories/GHSA-5q9x-554g-9jggVendor Advisory
https://www.vulncheck.com/advisories/surrealdb-before-ssrf-via-http-redirect-bypassThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.