CVE-2024-58361
SurrealDB before 2.0.4 Denial of Service via Parser Exception
- State
- Published
- Severity
- 7.1 High
- Published
- Jul 18, 2026
- Updated
- Jul 28, 2026
- Reserved
- Jul 18, 2026
Description
SurrealDB versions before 2.0.4 contain an uncaught exception handling vulnerability in the parser error rendering code when processing empty strings. Authorized clients can execute malformed queries with empty string conversions to record, duration, or datetime types that cause a panic in error rendering, crashing the server.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | VulnCheck |
Weaknesses
- CWE-248 Uncaught Exception
Affected Products
| Product | Versions |
|---|---|
surrealdbsurrealdb |
|
surrealdbsurrealdb |
|
References
- GitHub Security Advisory (GHSA-qjrv-v6qp-x99x)vendor-advisory
- VulnCheck Advisory: SurrealDB before 2.0.4 Denial of Service via Parser Exceptionthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.