CVE-2024-58361: SurrealDB denial of service via uncaught exception in parser

Executive brief

SurrealDB is a multi-model cloud database used for managing and querying data. A vulnerability in how the database handles certain malformed queries allows an authorized user to crash the server. This results in a denial-of-service, making the database unavailable for legitimate business operations until it is restarted.

Technical details

An uncaught exception (CWE-248) exists in the SurrealDB parser's error rendering logic. When an authorized client submits a query that attempts to convert an empty string into specific types—such as record, duration, or datetime—the parser fails. The subsequent error rendering code fails to handle this state correctly and triggers a Rust 'panic'. Because the exception is not caught, the entire database process terminates. This vulnerability is reachable over the network by any user with privileges to execute queries. The issue is resolved in version 2.0.4.

Affected products

• SurrealDB SurrealDB >= 2.0.0, < 2.0.4
• SurrealDB surrealdb-core >= 2.0.0, < 2.0.4

Timeline

• 2024-10-08: advisory: Original GitHub Security Advisory published
• 2026-07-18: disclosed: CVE published to NVD
• 2024-10-08: patched: Version 2.0.4 released to address the issue

References

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-qjrv-v6qp-x99x
• https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-parser-exception