SurrealDB Memory Exhaustion Vulnerability in String Replace Function Prior to 2.2.2

A memory exhaustion vulnerability has been identified in SurrealDB versions prior to 2.2.2. This issue arises in the string::replace function, which fails to limit the length of resulting strings when regex patterns are used. An authenticated attacker can exploit this by crafting a malicious query that leads to unbounded string allocations, exhausting server memory and causing a denial-of-service condition.

Impact

Exploitation of this vulnerability allows an authenticated user to cause a denial-of-service condition by exhausting the server's memory resources.

Remediation

Users can update to SurrealDB versions 2.2.2, 2.1.5, or 2.0.5 to address this vulnerability. For those unable to update, it is recommended to limit the use of the string::replace function in the affected versions by using the --deny-functions flag or the SURREAL_CAPS_DENY_FUNC environment variable.