This vulnerability in SurrealDB arises from the lack of a default execution-time limit on embedded JavaScript scripting functions when scripting capabilities are enabled via --allow-scripting or --allow-all flags. Without this limit, an authenticated attacker can submit long-running scripts that consume excessive server resources, leading to denial of service. The vulnerability affects SurrealDB versions prior to 2.0.5, 2.1.x versions before 2.1.5, and 2.2.x versions before 2.2.2. By default, scripting is disabled, so the risk is limited to environments where scripting is explicitly enabled.

An authenticated attacker can cause a denial of service by submitting long-running JavaScript functions that exhaust server resources. This can degrade or disrupt the availability of the SurrealDB service. There is no indication of data confidentiality or integrity impact. The vulnerability requires scripting to be enabled, which is not the default configuration.

Upgrade SurrealDB to version 2.0.5 or later, 2.1.5 or later, or 2.2.2 or later, where this issue is addressed by enforcing execution-time limits on embedded JavaScript functions. If upgrading is not immediately possible, ensure that scripting is not enabled unless necessary, as it is disabled by default. No additional vendor advisory or patch links are provided; check official SurrealDB resources for confirmation and updates.