Executive brief
SurrealDB is a multi-model cloud database. A vulnerability in how the database handles certain queries allows an authorized user to crash the server by calling functions that do not exist. This results in a denial-of-service (DoS) condition, making the database unavailable for all users and applications until it is restarted.
Technical details
An uncaught exception (CWE-248) exists in the SurrealDB query executor. The vulnerability is triggered when the engine processes a pre-parsed query that invokes a built-in function that does not exist in the server's current version. An authenticated attacker with network access and permissions to execute queries can provide a specially crafted query to trigger a 'panic' in the Rust-based engine. This panic causes the entire server process to terminate, resulting in a denial of service. The issue is resolved in SurrealDB version 1.2.0.
Affected products
- SurrealDB SurrealDB < 1.2.0
Timeline
- 2024-02-19: advisory: GitHub Security Advisory published
- 2026-07-18: disclosed: NVD publication date