This vulnerability (CVE-2025-71396) affects SurrealDB versions prior to 2.0.5, 2.1.x prior to 2.1.5, and 2.2.x prior to 2.2.2. When the embedded JavaScript scripting feature is explicitly enabled via command-line options (--allow-scripting or --allow-all), there is no enforced default execution-time limit on JavaScript functions. An authenticated attacker can exploit this by submitting long-running scripts that consume excessive server resources, leading to denial of service. The vulnerability is categorized under CWE-770 (Allocation of Resources Without Limits or Throttling).

An authenticated attacker can cause a denial of service by exhausting server resources through long-running JavaScript functions. There is no impact on confidentiality or integrity, only availability is affected. Since scripting is disabled by default, the risk is limited to environments where scripting is explicitly enabled.

Upgrade SurrealDB to version 2.0.5, 2.1.5, or 2.2.2 or later where this issue is fixed. If upgrading is not immediately possible, avoid enabling embedded JavaScript scripting features (--allow-scripting or --allow-all) to prevent exposure. Patch status is not explicitly stated in the input, but the affected versions indicate fixed versions exist. Check vendor advisories for official patches and updates.