What is GHSA-x3fg-mm84-q54h?

GHSA-x3fg-mm84-q54h is a security advisory published by GitHub Security Advisories with High severity. SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module...

Which CVE IDs does GHSA-x3fg-mm84-q54h cover?

GHSA-x3fg-mm84-q54h covers the following CVE IDs: CVE-2025-71391. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-x3fg-mm84-q54hHigh

SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module...

Vendor

GitHub Security Advisories

Published

July 18, 2026

Last Modified

July 18, 2026

🔗 CVE IDs covered (1)

CVE-2025-71391 →

📋 Description

SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module that allows authenticated users to crash the database. Attackers can send crafted HTTP queries containing null bytes to the /sql endpoint, causing an unhandled exception that crashes the SurrealDB instance and any dependent applications.

🔗 References (4)

https://github.com/surrealdb/surrealdb/security/advisories/GHSA-rq86-9m6r-cm3g
https://nvd.nist.gov/vuln/detail/CVE-2025-71391
https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-sql-endpoint
https://github.com/advisories/GHSA-x3fg-mm84-q54h