Executive brief
SurrealDB is a multi-model cloud database used for managing and querying large-scale data. A vulnerability in how the database handles malformed queries allows an authorized user to crash the server. This results in a denial-of-service (DoS) condition, disrupting database availability and business operations until the service is restarted.
Technical details
An uncaught exception (CWE-248) exists in SurrealDB's query parsing logic, specifically within the span rendering component. The vulnerability is triggered when the parser encounters a malformed SurrealQL query where the syntax error coincides with a line terminator character. An authenticated attacker with network access and permissions to execute queries can exploit this to trigger a Rust 'panic'. Because the exception is not caught, the panic causes the entire database process to terminate. The issue is resolved in version 1.2.1.
Affected products
- SurrealDB SurrealDB < 1.2.1
Timeline
- 2024-02-19: advisory: GitHub Security Advisory published
- 2026-07-18: disclosed: NVD publication date