CVE-2024-58359
Received Received - Intake

SurrealDB Denial of Service via ORDER BY rand() Clause

Publication date: 2026-07-18

Last updated on: 2026-07-18

Assigner: VulnCheck

Description
SurrealDB versions before 2.1.0 contain a denial of service vulnerability in the sorting mechanism when using ORDER BY rand() clause. Authorized clients can execute queries with ORDER BY rand() to trigger a panic in the sorting function, crashing the server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-18
Last Modified
2026-07-18
Generated
2026-07-18
AI Q&A
2026-07-18
EPSS Evaluated
N/A
NVD
CVE-2024-58359
EUVD
EUVD-2024-55676

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
surrealdb surrealdb to 2.1.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-248 An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SurrealDB versions before 2.1.0 have a denial of service vulnerability in the sorting mechanism when using the ORDER BY rand() clause. Authorized clients can execute queries with ORDER BY rand() to trigger a panic in the sorting function, causing the server to crash.

Detection Guidance

Check SurrealDB version with command: surrealdb version. If version is below 2.1.0, the system is vulnerable. Monitor for server crashes when ORDER BY rand() queries are executed.

Impact Analysis

This vulnerability allows authorized clients to crash the SurrealDB server by executing a specific query. This results in a denial of service, making the database unavailable until it is restarted. Users may experience downtime and loss of access to their data.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by causing unplanned downtime, potentially leading to violations of availability requirements. Downtime may disrupt access to personal or sensitive data, affecting data integrity and availability obligations under these regulations.

Mitigation Strategies

Upgrade SurrealDB to version 2.1.0 or later. Restrict untrusted clients from running arbitrary SurrealQL queries. Configure auto-restart for the SurrealDB process to recover from crashes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2024-58359. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart