CVE-2024-58357: SurrealDB denial of service via uncaught exception in rand::time

CVE-2024-58357 · Severity: medium · CVSS 6.5 · Published 2026-07-18

SurrealDB is a multi-model cloud database used for managing application data. A vulnerability in its random time generation function allows an authorized user to crash the database server by sending specific queries. This results in a denial of service, making the database and any dependent applications unavailable until the service is restarted.

Technologies: surrealdb (crates.io), surrealdb-core (crates.io), Surrealdb-Core. Vendors: crates.io, SurrealDB.

Quick answers

Is CVE-2024-58357 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-58357 being exploited in the wild.
How severe is CVE-2024-58357?
Medium severity, with a CVSS score of 6.5, published 18 July 2026.
Which products and versions are affected?
surrealdb (crates.io) SEMVER:introduced=0,fixed=2.1.0; surrealdb-core (crates.io) SEMVER:introduced=0,fixed=2.1.0; Surrealdb-Core < 2.1.0.
Is there a fix for CVE-2024-58357?
Yes. surrealdb (crates.io): upgrade to 2.1.0 or later; surrealdb-core (crates.io): upgrade to 2.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-58357 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2024-58357?
Check whether you run surrealdb (crates.io), surrealdb-core (crates.io) or Surrealdb-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • surrealdb (crates.io): upgrade to 2.1.0 or later
    cargo update -p surrealdb
  • surrealdb-core (crates.io): upgrade to 2.1.0 or later
    cargo update -p surrealdb-core

Technical details

An uncaught exception (CWE-248) exists in the rand::time() function of SurrealQL. The vulnerability is caused by calling .unwrap() on a None result returned by the timestamp_opt function from the underlying chrono crate. An authenticated attacker with permissions to execute queries can repeatedly invoke rand::time() to trigger a server panic. This leads to a process crash and denial of service. The issue is resolved in version 2.1.0 by implementing graceful error handling for the timestamp generation.

Affected products

  • surrealdb surrealdb < 2.1.0
  • surrealdb surrealdb-core < 2.1.0

Identifiers

  • CVE-2024-58357
  • GHSA-h4f5-h82v-5w4r

Timeline

  • 2024-11-22: advisory: GitHub Security Advisory published
  • 2026-07-18: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.