CVE-2024-58361

MediumCVSS 6.5/10Last modified Oct 27, 2026

Description

SurrealDB versions before 2.0.4 contain an uncaught exception handling vulnerability in the parser error rendering code when processing empty strings. Authorized clients can execute malformed queries with empty string conversions to record, duration, or datetime types that cause a panic in error rendering, crashing the server.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-248

Affected software

Vendor	Product	Versions
surrealdb	surrealdb	>= 2.0.0, < 2.0.4
surrealdb	surrealdb	>= 2.0.0, < 2.0.4

References

https://github.com/surrealdb/surrealdb/security/advisories/GHSA-qjrv-v6qp-x99xVendor Advisory
https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-parser-exceptionThird Party Advisory

Timeline

Published: Jul 18, 2026
Last modified: Oct 27, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-583628.8SurrealDB before 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) accepts an arbitrary object in the signin and signup operations of the RPC API w CVE-2024-583636.3SurrealDB before 1.5.4 and 2.0.0-alpha.1 before 2.0.0-alpha.6 fails to properly validate authentication when a scope user switches databases CVE-2024-583646.5SurrealDB versions before 1.2.1 contain an uncaught exception handling vulnerability in span rendering when parsing queries with errors on l CVE-2024-583656.5SurrealDB versions before 1.2.0 contain an uncaught exception vulnerability in the query executor when processing calls to nonexistent built CVE-2024-583668.8SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Atta CVE-2024-583676.5SurrealDB versions before 2.0.4 fail to properly enforce field permissions during SELECT, UPDATE, and DELETE operations, allowing authorized CVE-2024-583687.5SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API requests containing special characters. U CVE-2024-583696.5SurrealDB versions before 1.1.1 fail to properly validate invocation of custom parameters and functions at root or namespace levels, causing CVE-2024-58378.8Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially perform out of bounds memory access vi CVE-2024-583706.5SurrealDB versions before 1.1.0 fail to enforce recursion depth limits when parsing nested SurrealQL statements including IF, RELATE, and at CVE-2024-583747.5Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet endpoint that allows remote unauthenticate CVE-2024-583757.5OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation o