SurrealDB prior to versions 2.0.5, 2.1.5, and 2.2.2 permits authenticated users with OWNER or EDITOR privileges at various levels to define custom database functions using nested FOR loops. Although iteration counts for single loops are limited, nesting multiple loops allows attackers to execute functions that consume all server CPU time. Configured timeouts do not interrupt this execution, resulting in the server becoming unresponsive to other queries and connections until a manual restart is performed. This vulnerability is tracked as CVE-2025-71397 and is categorized under CWE-835 (Loop with Unreachable Exit Condition).

An attacker with OWNER or EDITOR permissions can cause a denial of service by exhausting server CPU resources through nested loops in custom functions. This leads to the server becoming unresponsive and unavailable to legitimate users until manually restarted. The vulnerability impacts server availability but does not indicate data confidentiality or integrity compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict OWNER or EDITOR permissions to trusted users only and monitor for unusual function definitions involving nested loops. Consider manual intervention to restart the server if it becomes unresponsive due to this issue.