CVE-2025-71390

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-71390
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-71390.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-71390
Aliases
Published
2026-07-18T13:10:10Z
Modified
2026-08-15T11:45:33Z
Severity
  • 5.8 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H CVSS Calculator
Summary
SurrealDB before 2.3.6 deny-net Bypass via DNS Resolution
Details

SurrealDB before 2.2.6, 2.3.6, and 2.1.8 (and 3.0.0-alpha.7 and earlier) fails to validate DNS-resolved hostnames against --deny-net network access restrictions in its http::* functions. An authenticated user can invoke http::() with a hostname that resolves to a denied IP address, causing the server to issue the request anyway and return the response. This bypasses network access controls, allowing access to restricted internal endpoints and potentially retrieving or altering sensitive information and credentials, depending on the deployment.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71390.json"
}
References

Affected packages

Git / github.com/surrealdb/surrealdb

Affected ranges

Type
GIT
Repo
https://github.com/surrealdb/surrealdb
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
bfeb551d03867274571a715bcaf359de5e1000ae
Introduced
0ee8dc2c3ec8e883038d0ee00bbce6a6126fe655
Fixed
abdb3a6fd119a86773f1c29d06de06b7b4310272
Introduced
c59db3bbfb8d3eab03f47129a2d77812311cfd69
Fixed
7f4cfd44e9ef53e6c59980e35ddd7f65f4a7e536
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.1.8"
        },
        {
            "introduced": "2.2.0"
        },
        {
            "fixed": "2.2.6"
        },
        {
            "introduced": "2.3.0"
        },
        {
            "fixed": "2.3.6"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

v0.*
v0.1.0
v0.1.1
v0.1.10
v0.1.11
v0.1.12
v0.1.13
v0.1.14
v0.1.15
v0.1.16
v0.1.17
v0.1.18
v0.1.19
v0.1.2
v0.1.20
v0.1.21
v0.1.22
v0.1.23
v0.1.24
v0.1.25
v0.1.26
v0.1.27
v0.1.28
v0.1.29
v0.1.3
v0.1.30
v0.1.4
v0.1.5
v0.1.6
v0.1.7
v0.1.8
v0.1.9
v0.3.0
v1.*
v1.0.0
v1.0.0-beta.1
v1.0.0-beta.10
v1.0.0-beta.11
v1.0.0-beta.12
v1.0.0-beta.2
v1.0.0-beta.3
v1.0.0-beta.4
v1.0.0-beta.5
v1.0.0-beta.6
v1.0.0-beta.7
v1.0.0-beta.8
v1.0.0-beta.9
v1.0.0-beta.9+20230402
v2.*
v2.0.0
v2.0.0-alpha.1
v2.0.0-alpha.2
v2.0.0-alpha.3
v2.0.0-alpha.4
v2.0.0-alpha.5
v2.0.0-alpha.6
v2.0.0-alpha.7
v2.0.0-alpha.8
v2.0.0-alpha.9
v2.0.0-beta.1
v2.0.0-beta.2
v2.0.0-beta.3
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.1.0
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.3.0
v2.3.1
v2.3.2
v2.3.4
v2.3.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-71390.json"