Executive brief
SurrealDB is a multi-model cloud database used for managing application data. A vulnerability in its random time generation function allows an authorized user to crash the database server by sending specific queries. This results in a denial of service, making the database and any dependent applications unavailable until the service is restarted.
Technical details
An uncaught exception (CWE-248) exists in the rand::time() function of SurrealQL. The vulnerability is caused by calling .unwrap() on a None result returned by the timestamp_opt function from the underlying chrono crate. An authenticated attacker with permissions to execute queries can repeatedly invoke rand::time() to trigger a server panic. This leads to a process crash and denial of service. The issue is resolved in version 2.1.0 by implementing graceful error handling for the timestamp generation.
Affected products
- surrealdb surrealdb < 2.1.0
- surrealdb surrealdb-core < 2.1.0
Timeline
- 2024-11-22: advisory: GitHub Security Advisory published
- 2026-07-18: disclosed: NVD publication date