CVE-2024-58359: SurrealDB denial of service in ORDER BY rand() sorting

CVE-2024-58359 · Severity: medium · CVSS 6.5 · Published 2026-07-18

SurrealDB is a multi-model database used for managing and querying large datasets. A vulnerability in its sorting mechanism allows an authorized user to crash the database server by running a specific type of query. This results in a denial of service, making the database unavailable for all users and applications until it is restarted.

Technologies: surrealdb (crates.io), surrealdb-core (crates.io), Surrealdb-Core. Vendors: crates.io, SurrealDB.

Quick answers

Is CVE-2024-58359 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-58359 being exploited in the wild.
How severe is CVE-2024-58359?
Medium severity, with a CVSS score of 6.5, published 18 July 2026.
Which products and versions are affected?
surrealdb (crates.io) SEMVER:introduced=0,fixed=2.1.0; surrealdb-core (crates.io) SEMVER:introduced=0,fixed=2.1.0; Surrealdb-Core < 2.1.0.
Is there a fix for CVE-2024-58359?
Yes. surrealdb (crates.io): upgrade to 2.1.0 or later; surrealdb-core (crates.io): upgrade to 2.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-58359 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2024-58359?
Check whether you run surrealdb (crates.io), surrealdb-core (crates.io) or Surrealdb-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • surrealdb (crates.io): upgrade to 2.1.0 or later
    cargo update -p surrealdb
  • surrealdb-core (crates.io): upgrade to 2.1.0 or later
    cargo update -p surrealdb-core

Technical details

A denial of service vulnerability exists in SurrealDB's sorting mechanism due to an uncaught exception (CWE-248). The root cause is a comparison function used with the 'ORDER BY rand()' clause that fails to implement total order, which triggers a panic in the Rust 1.81+ runtime environment. An attacker with network access and low-level query privileges can execute a crafted SurrealQL query to crash the server process. The issue is resolved in version 2.1.0, which updates the sorting algorithm to guarantee total order.

Affected products

  • surrealdb surrealdb < 2.1.0
  • surrealdb surrealdb-core < 2.1.0

Identifiers

  • CVE-2024-58359
  • GHSA-m52v-24p8-654f

Timeline

  • 2024-11-22: advisory: GHSA-m52v-24p8-654f published
  • 2026-07-18: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.