SurrealDB versions prior to 2.2.2 have a memory exhaustion vulnerability in the string::replace function when regex patterns are used. An authenticated attacker can craft a malicious query that causes unbounded string allocations, exhausting server memory and resulting in a denial of service. The flaw stems from a lack of length restriction on the output of the replace operation, allowing excessive allocation, and is classified as CWE‑789.

SurrealDB is the affected product. Any deployment using a version earlier than 2.2.2 is vulnerable. No other software modules or components are listed as affected.

The CVSS score of 7.1 indicates a high severity vulnerability. The EPSS score is less than 1%, implying a low current exploitation probability, and the vulnerability is not cataloged in CISA's KEV. Exploitation requires authenticated access to SurrealDB; the attacker must submit a specifically crafted query to trigger large memory allocations and force the service to become unresponsive.