{"action":"Upgrade SurrealDB to 2.1.8 or later.","affected":[{"fixed":"2.1.8","introduced":"2.1.0"},{"fixed":"2.2.6","introduced":"2.2.0"},{"fixed":"3.0.0-alpha.7","introduced":"3.0.0-alpha.1"},{"fixed":"2.3.6","introduced":"2.3.0"}],"component":"SurrealDB","cve_ids":["CVE-2025-71390"],"ecosystem":"crates.io","epss":0.00248,"exploited":false,"fixed_versions":["2.1.8","2.2.6","3.0.0-alpha.7","2.3.6"],"ghsa_id":"GHSA-m3c3-78fh-w3w7","id":"tcs_01M5KF1CYVZAT6SVDPN9389FQT","modified_at":"2026-09-04T17:45:04.695447096Z","published_at":"2026-09-04T17:30:45Z","references":["https://osv.dev/vulnerability/GHSA-m3c3-78fh-w3w7","https://github.com/surrealdb/surrealdb/security/advisories/GHSA-m3c3-78fh-w3w7","https://nvd.nist.gov/vuln/detail/CVE-2025-71390","https://github.com/surrealdb/surrealdb/pull/6101","https://github.com/surrealdb/surrealdb/pull/6119","https://github.com/surrealdb/surrealdb/pull/6120","https://github.com/surrealdb/surrealdb/pull/6121","https://github.com/surrealdb/surrealdb/commit/4b317d850c7dabaee228144423741097232f7955","https://github.com/surrealdb/surrealdb/commit/7c574dfa90211923e2ff1b12510c8479f8805b3d","https://github.com/surrealdb/surrealdb/commit/b80d7d08b043c0e4bc0b7ff8ddb9be0907c0bf59","https://github.com/surrealdb/surrealdb/commit/d5dc46f1c255ed450b3af025a0bdc165b6ce54a3","https://github.com/surrealdb/surrealdb","https://www.vulncheck.com/advisories/surrealdb-before-deny-net-bypass-via-dns-resolution"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-m3c3-78fh-w3w7","url":"https://osv.dev/vulnerability/GHSA-m3c3-78fh-w3w7"}],"summary":"SurrealDB allows bypass of deny-net flags via DNS resolution"}