Executive brief
SurrealDB is a multi-model database used for managing and querying large datasets. A vulnerability in its sorting mechanism allows an authorized user to crash the database server by running a specific type of query. This results in a denial of service, making the database unavailable for all users and applications until it is restarted.
Technical details
A denial of service vulnerability exists in SurrealDB's sorting mechanism due to an uncaught exception (CWE-248). The root cause is a comparison function used with the 'ORDER BY rand()' clause that fails to implement total order, which triggers a panic in the Rust 1.81+ runtime environment. An attacker with network access and low-level query privileges can execute a crafted SurrealQL query to crash the server process. The issue is resolved in version 2.1.0, which updates the sorting algorithm to guarantee total order.
Affected products
- surrealdb surrealdb < 2.1.0
- surrealdb surrealdb-core < 2.1.0
Timeline
- 2024-11-22: advisory: GHSA-m52v-24p8-654f published
- 2026-07-18: disclosed: NVD publication date