{"id":"CVE-2025-71398","title":"SurrealDB before 2.2.2 fails to validate HTTP redirects in http functions, allowing authenticated users to bypass deny-net restrictions by redirecting to blocked IP addresses","summary":"SurrealDB before 2.2.2 fails to validate HTTP redirects in http functions, allowing authenticated users to bypass deny-net restrictions by redirecting to blocked IP addresses. Attackers can host a public server that redirects to denied n…","severity":"high","cvss":7.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","cwe":["CWE-918"],"vendor":"surrealdb","product":"surrealdb","affected":["surrealdb < 2.2.2"],"patched":["surrealdb 2.2.2"],"published":"2026-07-18","updated":"2026-09-29","sourceUpdated":"2026-09-29T19:10:00.160","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-71398","references":[{"url":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-5q9x-554g-9jgg","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/surrealdb-before-ssrf-via-http-redirect-bypass","label":"disclosure@vulncheck.com"}],"tags":["nvd"],"epss":0.00328,"epssPercentile":0.25793,"ingestedAt":"2026-07-19T05:29:21.322Z","slug":"CVE-2025-71398","body":"## Overview\n\nSurrealDB before 2.2.2 fails to validate HTTP redirects in http functions, allowing authenticated users to bypass deny-net restrictions by redirecting to blocked IP addresses. Attackers can host a public server that redirects to denied network targets, enabling server-side request forgery to access internal endpoints and retrieve sensitive information.\n\n## Affected\n\n- `surrealdb < 2.2.2`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `surrealdb 2.2.2`","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":212735,"id":"CVE-2025-71398","ts":1790700010980,"field":"cvss","old":null,"new":"7.6"},{"seq":212734,"id":"CVE-2025-71398","ts":1790700010980,"field":"severity","old":"none","new":"high"}]}