CVE-2025-71390

UNKNOWN 0.0

SurrealDB before 2.3.6 deny-net Bypass via DNS Resolution

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

SurrealDB before 2.2.6, 2.3.6, and 2.1.8 (and 3.0.0-alpha.7 and earlier) fails to validate DNS-resolved hostnames against --deny-net network access restrictions in its http::* functions. An authenticated user can invoke http::<fn>(<url>) with a hostname that resolves to a denied IP address, causing the server to issue the request anyway and return the response. This bypasses network access controls, allowing access to restricted internal endpoints and potentially retrieving or altering sensitive information and credentials, depending on the deployment.

CWE	CWE-863
Vendor	surrealdb
Product	surrealdb
Published	Jul 18, 2026

Stay Ahead of the Next One

Get instant alerts for surrealdb surrealdb

Be the first to know when new unknown vulnerabilities affecting surrealdb surrealdb are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

surrealdb / surrealdb

0 < 2.3.6, 2.2.6

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/surrealdb/surrealdb/security/advisories/GHSA-m3c3-78fh-w3w7 vulncheck.com: https://www.vulncheck.com/advisories/surrealdb-before-deny-net-bypass-via-dns-resolution

Credits

🔍 manelmontilla