CVE-2024-58370
SurrealDB before 1.1.0 Uncontrolled Recursion Denial of Service
- State
- Published
- Severity
- 7.1 High
- Published
- Jul 18, 2026
- Updated
- Jul 28, 2026
- Reserved
- Jul 18, 2026
Description
SurrealDB versions before 1.1.0 fail to enforce recursion depth limits when parsing nested SurrealQL statements including IF, RELATE, and attribute access idioms. Authorized attackers can submit queries with excessive nesting depth to cause stack overflow and crash the server.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | VulnCheck |
Weaknesses
- CWE-674 Uncontrolled Recursion
Affected Products
| Product | Versions |
|---|---|
surrealdbsurrealdb |
|
References
- GitHub Security Advisory (GHSA-6r8p-hpg7-825g)vendor-advisory
- VulnCheck Advisory: SurrealDB before 1.1.0 Uncontrolled Recursion Denial of Servicethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.