{"items":[{"id":"NVI-00016392","kind":"vulnerability","title":"SurrealDB bypass of deny-net flags via redirect results in server-side request forgery (SSRF)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-5q9x-554g-9jgg","CVE-2025-71398"],"plain_summary":"GitHub lists this reviewed advisory for surrealdb, surrealdb, surrealdb. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-6d24fa85a6e2b107ce2ce5bc38ee52ef"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-6d24fa85a6e2b107ce2ce5bc38ee52ef","url":"https://github.com/advisories/GHSA-5q9x-554g-9jgg","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-5q9x-554g-9jgg","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T02:20:52.377Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-6d24fa85a6e2b107ce2ce5bc38ee52ef"],"technology":"surrealdb","known_exclusions":[],"conditions_summary":"SurrealDB offers http functions that can access external network endpoints. A typical, albeit not recommended  configuration would be to start SurrealDB with all network connections allowed with the exception of a deny list. For example, `surreal start --allow-net --deny-net 10.0.0.0/8` will allow all network connections except to the 10.0.0.0/8 block.\n\nAn authenticated user of SurrealDB can use redirects to bypass this restriction. For example by hosting a server on the public internet which redirects to the IP addresses blocked by the administrator of the SurrealDB server via HTTP 301 or 307 response codes. \n\nWhen sending SurrealDB statements containing the `http::*` functions to the attacker controlled host, the SurrealDB server will follow the redirects to the blocked IP address. Because the statements also return the responses to the attacker, this issue constitutes a full SSRF vulnerability.\n\nThis issue was discovered and patched during an code audit and penetration test of SurrealDB by cure53, the severity as defined within cure53's preliminary f","public_affected_ranges":[">= 2.2.0, < 2.2.2"]},{"certainty":"source_listed","source_ids":["sr-6d24fa85a6e2b107ce2ce5bc38ee52ef"],"technology":"surrealdb","known_exclusions":[],"conditions_summary":"SurrealDB offers http functions that can access external network endpoints. A typical, albeit not recommended  configuration would be to start SurrealDB with all network connections allowed with the exception of a deny list. For example, `surreal start --allow-net --deny-net 10.0.0.0/8` will allow all network connections except to the 10.0.0.0/8 block.\n\nAn authenticated user of SurrealDB can use redirects to bypass this restriction. For example by hosting a server on the public internet which redirects to the IP addresses blocked by the administrator of the SurrealDB server via HTTP 301 or 307 response codes. \n\nWhen sending SurrealDB statements containing the `http::*` functions to the attacker controlled host, the SurrealDB server will follow the redirects to the blocked IP address. Because the statements also return the responses to the attacker, this issue constitutes a full SSRF vulnerability.\n\nThis issue was discovered and patched during an code audit and penetration test of SurrealDB by cure53, the severity as defined within cure53's preliminary f","public_affected_ranges":[">= 2.1.0, < 2.1.5"]},{"certainty":"source_listed","source_ids":["sr-6d24fa85a6e2b107ce2ce5bc38ee52ef"],"technology":"surrealdb","known_exclusions":[],"conditions_summary":"SurrealDB offers http functions that can access external network endpoints. A typical, albeit not recommended  configuration would be to start SurrealDB with all network connections allowed with the exception of a deny list. For example, `surreal start --allow-net --deny-net 10.0.0.0/8` will allow all network connections except to the 10.0.0.0/8 block.\n\nAn authenticated user of SurrealDB can use redirects to bypass this restriction. For example by hosting a server on the public internet which redirects to the IP addresses blocked by the administrator of the SurrealDB server via HTTP 301 or 307 response codes. \n\nWhen sending SurrealDB statements containing the `http::*` functions to the attacker controlled host, the SurrealDB server will follow the redirects to the blocked IP address. Because the statements also return the responses to the attacker, this issue constitutes a full SSRF vulnerability.\n\nThis issue was discovered and patched during an code audit and penetration test of SurrealDB by cure53, the severity as defined within cure53's preliminary f","public_affected_ranges":["< 2.0.5"]}],"null_published_at":"2026-11-04T10:04:27.938Z","source_updated_at":"2026-09-04T19:34:53.000Z","source_disclosed_at":"2025-04-11T14:09:37.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-02T02:20:52.377Z"}],"next_cursor":null,"snapshot_revision":"42594"}