What is GHSA-x3fg-mm84-q54h?

GHSA-x3fg-mm84-q54h is a security advisory published by GitHub Security Advisories with High severity. SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module...

Which CVE IDs does GHSA-x3fg-mm84-q54h cover?

GHSA-x3fg-mm84-q54h covers the following CVE IDs: CVE-2025-71391. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-x3fg-mm84-q54h?

GHSA-x3fg-mm84-q54h has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

GHSA-x3fg-mm84-q54hHighCVSS 6.5

SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module...

Vendor

GitHub Security Advisories

Published

July 18, 2026

Last Modified

August 13, 2026

🔗 CVE IDs covered (1)

CVE-2025-71391 →

📋 Description

SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module that allows authenticated users to crash the database. Attackers can send crafted HTTP queries containing null bytes to the /sql endpoint, causing an unhandled exception that crashes the SurrealDB instance and any dependent applications.

🔗 References (4)

https://github.com/surrealdb/surrealdb/security/advisories/GHSA-rq86-9m6r-cm3g
https://nvd.nist.gov/vuln/detail/CVE-2025-71391
https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-sql-endpoint
https://github.com/advisories/GHSA-x3fg-mm84-q54h