Threats tagged 'ghsa-9jwv-m2gr-h32r'

SurrealDB versions 3.1.0 up to but not including 3.3.0 contain a server-side request forgery (SSRF) vulnerability in the network-capability matching logic. The issue arises because port-specific deny-net rules match only literal host strings, while the resolved IP check ignores the port, allowing authenticated users to bypass restrictions and access blocked internal services via crafted http::* function calls.