CVE-2024-58358
Received Received - Intake

SurrealDB Role Conversion Denial of Service Vulnerability

Publication date: 2026-07-18

Last updated on: 2026-07-18

Assigner: VulnCheck

Description
SurrealDB versions before 2.1.0 contain a denial of service vulnerability in role conversion that allows privileged owner users to define users with nonexistent roles. Attackers can trigger an uncaught panic by signing in with a user assigned an invalid role, crashing the server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-18
Last Modified
2026-07-18
Generated
2026-07-18
AI Q&A
2026-07-18
EPSS Evaluated
N/A
NVD
CVE-2024-58358
EUVD
EUVD-2024-55675

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
surrealdb surrealdb to 2.1.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-248 An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2024-58358 is a denial of service vulnerability in SurrealDB versions before 2.1.0. It occurs when a privileged owner user defines another user with a nonexistent role. The system crashes with an uncaught panic when the invalid user signs in, causing the server to stop responding.

Detection Guidance

Check SurrealDB server version with: surrealdb version. If version is below 2.1.0, the system is vulnerable. Monitor server logs for panic errors during user sign-ins, which may indicate exploitation attempts.

Impact Analysis

This vulnerability allows attackers to crash the SurrealDB server by signing in with a user assigned an invalid role. This results in a denial of service, making the database unavailable for legitimate users. The impact is high availability disruption for the database system.

Compliance Impact

This vulnerability primarily impacts availability by causing server crashes, which could lead to prolonged downtime for systems processing sensitive data. For GDPR, this may result in unauthorized disruptions to data processing activities, potentially violating Article 32 requirements for availability and resilience. Under HIPAA, repeated downtime could affect access to protected health information, potentially compromising the integrity and availability of electronic protected health information (ePHI) as required by the Security Rule.

Mitigation Strategies

Upgrade SurrealDB to version 2.1.0 or later immediately. Restrict owner role access to only trusted users. Implement automatic server restart mechanisms to recover from potential crashes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2024-58358. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart