tocsin

crates.io/SurrealDB CVE-2025-71390: medium, EPSS 0.25%

SurrealDB allows bypass of deny-net flags via DNS resolution

Action: Upgrade SurrealDB to 2.1.8 or later.

cargo update -p SurrealDB --precise 2.1.8
cargo update -p SurrealDB --precise 2.2.6
cargo update -p SurrealDB --precise 3.0.0-alpha.7
cargo update -p SurrealDB --precise 2.3.6

Affected

introducedfixedlast affected
2.1.02.1.8-
2.2.02.2.6-
3.0.0-alpha.13.0.0-alpha.7-
2.3.02.3.6-

Fixed versions

2.1.82.2.63.0.0-alpha.72.3.6

Sources

CVE-2025-71390 · published · modified · JSON