---
id: CVE-2025-71390
title: >-
  SurrealDB before 2.2.6, 2.3.6, and 2.1.8 (and 3.0.0-alpha.7 and earlier) fails
  to validate DNS-resolved hostnames against --deny-net network access
  restrictions in its http::* functions
summary: >-
  SurrealDB before 2.2.6, 2.3.6, and 2.1.8 (and 3.0.0-alpha.7 and earlier) fails
  to validate DNS-resolved hostnames against --deny-net network access
  restrictions in its http::* functions. An authenticated user can invoke
  http::<fn>(<url>)…
severity: none
cwe:
  - CWE-863
published: '2026-07-18'
updated: '2026-07-18'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-71390'
references:
  - url: >-
      https://github.com/surrealdb/surrealdb/security/advisories/GHSA-m3c3-78fh-w3w7
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/surrealdb-before-deny-net-bypass-via-dns-resolution
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-07-19T05:29:21.146Z'
epss: 0.00248
epssPercentile: 0.14334
---

## Overview

SurrealDB before 2.2.6, 2.3.6, and 2.1.8 (and 3.0.0-alpha.7 and earlier) fails to validate DNS-resolved hostnames against --deny-net network access restrictions in its http::* functions. An authenticated user can invoke http::<fn>(<url>) with a hostname that resolves to a denied IP address, causing the server to issue the request anyway and return the response. This bypasses network access controls, allowing access to restricted internal endpoints and potentially retrieving or altering sensitive information and credentials, depending on the deployment.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.