CVE-2024-58361
Received Received - Intake

SurrealDB Parser Error Handling Denial of Service

Publication date: 2026-07-18

Last updated on: 2026-07-18

Assigner: VulnCheck

Description
SurrealDB versions before 2.0.4 contain an uncaught exception handling vulnerability in the parser error rendering code when processing empty strings. Authorized clients can execute malformed queries with empty string conversions to record, duration, or datetime types that cause a panic in error rendering, crashing the server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-18
Last Modified
2026-07-18
Generated
2026-07-18
AI Q&A
2026-07-18
EPSS Evaluated
N/A
NVD
CVE-2024-58361
EUVD
EUVD-2024-55677

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
surrealdb surrealdb to 2.0.4 (exc)
surrealdb surrealdb 2.0.0
surrealdb surrealdb 2.0.1
surrealdb surrealdb 2.0.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-248 An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SurrealDB versions before 2.0.4 have a flaw where the server crashes when processing malformed queries with empty strings. Authorized clients can send queries that attempt to convert empty strings to specific data types like records, durations, or datetimes. This triggers an uncaught exception in the error handling code, causing a panic and server shutdown.

Detection Guidance

To detect this vulnerability, check the installed SurrealDB version using the command: surrealdb version. If the version is below 2.0.4, the system is vulnerable. Monitor server crashes or panics during query processing, especially with empty string conversions to record, duration, or datetime types.

Impact Analysis

This vulnerability can lead to a denial of service (DoS) where the SurrealDB server crashes and becomes unavailable. Authorized clients with malicious intent could exploit this to disrupt database operations. The impact is limited to availability; confidentiality and integrity of data are not affected.

Compliance Impact

This vulnerability primarily impacts availability, which could lead to service disruptions. For GDPR, repeated DoS incidents might affect data accessibility requirements. For HIPAA, downtime could impact access to protected health information. Mitigation involves patching to version 2.0.4 or later.

Mitigation Strategies

Upgrade SurrealDB to version 2.0.4 or later immediately. If upgrading is not possible, restrict untrusted clients from executing arbitrary queries and ensure the SurrealDB process auto-restarts after crashes to maintain availability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2024-58361. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart