Executive brief
SurrealDB is a multi-model cloud database. A vulnerability in versions prior to 1.1.1 allows an authorized user to crash the database server by running specific queries at the wrong administrative level. This results in a denial of service, potentially disrupting application availability and business operations until the service is restarted.
Technical details
A denial of service vulnerability exists in SurrealDB due to an uncaught exception (CWE-248) when processing custom parameters and functions. While these entities are only supported at the database level, the server fails to prevent their invocation at the root or namespace levels. An authenticated attacker with network access and permissions to run queries at these higher levels can trigger a server panic. This crash results in a complete loss of availability for the database instance. The issue is resolved in version 1.1.1.
Affected products
- SurrealDB SurrealDB < 1.1.1
Timeline
- 2024-01-17: advisory: GitHub Security Advisory published
- 2024-01-17: patched: Version 1.1.1 released
- 2026-07-18: disclosed: NVD publication date