Description
SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 does not enforce a default execution-time limit on embedded JavaScript scripting functions when the scripting capability is explicitly enabled (via --allow-scripting or --allow-all). An authenticated attacker can submit long-running JavaScript functions to exhaust server resources and cause a denial of service. Scripting is disabled by default.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
surrealdb surrealdb
Default version status: unaffected
2.2.0 to < 2.2.2affected2.2.2unaffected
pkg:cargo/surrealdbsurrealdb surrealdb
Default version status: unaffected
0 to < 2.0.5affected2.0.5unaffected
pkg:cargo/surrealdbsurrealdb surrealdb
Default version status: unaffected
2.1.0 to < 2.1.5affected2.1.5unaffected
pkg:cargo/surrealdb