Uncontrolled Recursion Affecting surrealdb-core package, versions <2.0.5>=2.1.0 <2.1.5>=2.2.0 <2.2.2

Affected versions of this package are vulnerable to Uncontrolled Recursion due to the improper handling of nested function calls in scripting environments. An attacker can exhaust system memory and cause a denial of service by creating recursive queries that bypass the recursion limit.

Note:

This is only exploitable if the SurrealDB server has scripting capabilities explicitly enabled with --allow-scripting or --allow-all and the environment variables SURREAL_CAPS_ALLOW_SCRIPT=true and SURREAL_CAPS_ALLOW_ALL=true.

This vulnerability can be mitigated by denying the execution of embedded scripting functions through the configuration of capabilities by starting SurrealDB with the --deny-scripting flag or the equivalent environment variable SURREAL_CAPS_DENY_SCRIPT=true.

• GitHub Commit