Medium, CVSS 5.8crates.ioAmendedPublished
SurrealDB allows bypass of deny-net flags via DNS resolution
CVE-2025-71390 · GHSA-m3c3-78fh-w3w7
- Affected
- crates.io SurrealDB >= 2.1.0, < 2.1.8; >= 2.2.0, < 2.2.6; >= 3.0.0-alpha.1, < 3.0.0-alpha.7; >= 2.3.0, < 2.3.6
- Fixed in
- 2.1.82.2.63.0.0-alpha.72.3.6· Vendor fix available
- Issue
- SurrealDB offers http functions that can access external network endpoints. A typical, albeit not recommended configuration would be to start SurrealDB with all network connections allowed with the exception of a deny list. For example, `surreal start --allow-net --deny-net 10.0.0.0/8` will allow all network connections except to the 10.0.0.0/8 block. An authenticated user of SurrealDB can use bypass this restriction, using `http:: ( )` functions where the hostname resolves to an IP within the `--deny-net` block. For example if a SurrealDB administrator wanted to restrict access to other services within a private network and thus set the `--deny-net` to a network IP range, this could be circumvented by an attacker leveraging DNS records and hostname resolution. When sending SurrealDB statements containing the `http::*` functions, if the hostname resolves…
Recommended action: Upgrade to 3.0.0-alpha.7 (pre-release), 2.3.6, 2.2.6 or 2.1.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.