The vulnerability in SurrealDB prior to version 2.2.2 involves the string::replace function failing to restrict the length of the output string when regex patterns are used. This flaw allows an authenticated attacker to trigger excessive memory consumption by submitting specially crafted queries, resulting in denial of service due to memory exhaustion. The issue is categorized under CWE-789 (Uncontrolled Memory Allocation). No known exploits in the wild have been reported. No patch links are provided, and the vendor has not confirmed a fix. The vulnerability has a high severity rating based on available data.

Successful exploitation leads to denial of service by exhausting server memory, which can disrupt availability of the SurrealDB service. The attacker must be authenticated to trigger the vulnerability. There is no indication of data disclosure or privilege escalation from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to authenticated users and monitor for unusual query patterns that may trigger excessive memory usage. Avoid using untrusted regex patterns in string::replace operations.