SurrealDB versions prior to 2.0.5, 2.1.0 up to but not including 2.1.5, and 2.2.0 up to but not including 2.2.2 allow authenticated users with OWNER or EDITOR permissions at various levels (root, namespace, or database) to define custom functions via DEFINE FUNCTION that use nested FOR loops. While single loops have constrained iteration counts, nested loops can multiply iterations (e.g., multiple loops each with 1,000,000 iterations), resulting in CPU exhaustion. The configured execution timeouts do not interrupt this behavior, rendering the database server unresponsive to other queries and connections until a manual restart occurs.

The vulnerability leads to a denial-of-service condition by exhausting server CPU resources, causing the SurrealDB server to become unresponsive. This impacts availability but does not affect confidentiality or integrity. The attack requires authenticated user privileges with OWNER or EDITOR roles.

A fix is available in SurrealDB versions 2.0.5, 2.1.5, and 2.2.2. Users should upgrade to these or later versions to remediate the vulnerability. Until patched, restrict OWNER and EDITOR permissions carefully to trusted users only. Manual server restarts are required to recover from an attack. Patch status is confirmed by the version information provided; no additional vendor advisory was included.