Executive brief
SurrealDB is an open-source database server that provides HTTP REST API access. An unauthenticated attacker can crash the SurrealDB server by sending specially crafted HTTP requests with malformed ID, DB, or NS headers containing certain special characters, causing a denial of service that makes the database unavailable until manually restarted.
Technical details
The vulnerability is an uncaught exception (CWE-248) in the SurrealDB HTTP REST API header parsing logic. When the ID, DB, or NS headers contain certain special characters that the parser does not properly handle, the parsing fails and raises an unhandled exception, causing a panic that crashes the entire SurrealDB process. The attack requires no authentication and is triggered via a simple HTTP request over the network (CVSS Attack Vector: Network, Privileges Required: None). An attacker can repeatedly send such requests to keep the SurrealDB service unavailable. The vulnerability affects only the SurrealDB binary server, not the library. It was patched in version 1.1.0 and later.
Affected products
- SurrealDB SurrealDB < 1.1.0
Timeline
- 2024-01-17: disclosed: Original advisory GHSA-m24x-r6q3-2vp9 published
- 2024-01-17: patched: Fixed in SurrealDB version 1.1.0 and later
- 2026-07-18: advisory: Duplicate advisory GHSA-f7q6-7rq9-3phx published (later withdrawn as duplicate)