https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 10:38:33 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2025-71396 <p>SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 does not enforce a default execution-time limit on embedded JavaScript scripting functions when the scripting capability is explicitly enabled (via --allow-scripting or --allow-all). An authenticated attacker can submit long-running JavaScript functions to exhaust server resources and cause a denial of service. Scripting is disabled by default.</p> <p>SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 does not enforce a default execution-time limit on embedded JavaScript scripting functions when the scripting capability is explicitly enabled (via --allow-scripting or --allow-all). An authenticated attacker can submit long-running JavaScript functions to exhaust server resources and cause a denial of service. Scripting is disabled by default.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2025-71396 https://vulnerability.circl.lu/vuln/ghsa-6g9r-xqrf-34xh <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> crates.io: surrealdb</p> <p>## Duplicate Advisory</p> <p>This advisory has been withdrawn because it is a duplicate of GHSA-3824-qmfq-2qv7. This link is maintained to preserve external references.</p> <p>## Original Description SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 does not enforce a default execution-time limit on embedded JavaScript scripting functions when the scripting capability is explicitly enabled (via --allow-scripting or --allow-all). An authenticated attacker can submit long-running JavaScript functions to exhaust server resources and cause a denial of service. Scripting is disabled by default.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> crates.io: surrealdb</p> <p>## Duplicate Advisory</p> <p>This advisory has been withdrawn because it is a duplicate of GHSA-3824-qmfq-2qv7. This link is maintained to preserve external references.</p> <p>## Original Description SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 does not enforce a default execution-time limit on embedded JavaScript scripting functions when the scripting capability is explicitly enabled (via --allow-scripting or --allow-all). An authenticated attacker can submit long-running JavaScript functions to exhaust server resources and cause a denial of service. Scripting is disabled by default.</p> https://vulnerability.circl.lu/vuln/ghsa-6g9r-xqrf-34xh