CVE-2024-58364: SurrealDB before 1.2.1 Denial of Service via Parsing Error

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-18 · updated 2026-10-27
Weakness: CWE-248

Description

SurrealDB versions before 1.2.1 contain an uncaught exception handling vulnerability in span rendering when parsing queries with errors on line terminator characters. Authorized clients can submit malformed queries that trigger a panic in the span rendering code, crashing the server and causing denial of service.

Affected products

surrealdb: before 1.2.1 — fixed in 1.2.1

How to fix

Upgrade to a fixed version: surrealdb 1.2.1. Check the vendor advisory for mitigations.

References

https://github.com/surrealdb/surrealdb/security/advisories/GHSA-8xff-473h-f863
https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-parsing-error

Get alerted when CVE-2024-58364 or the next vulnerability affects your stack