CVE-2024-58365

MediumCVSS 6.5/10Last modified Oct 27, 2026

Description

SurrealDB versions before 1.2.0 contain an uncaught exception vulnerability in the query executor when processing calls to nonexistent built-in functions. Authorized clients can craft pre-parsed queries invoking nonexistent functions to trigger a panic that crashes the server.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-248

Affected software

Vendor	Product	Versions
surrealdb	surrealdb	< 1.2.0

References

https://github.com/surrealdb/surrealdb/security/advisories/GHSA-6wr5-jmpr-mjcxVendor Advisory
https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-nonexistent-functionThird Party Advisory

Timeline

Published: Jul 18, 2026
Last modified: Oct 27, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-583668.8SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Atta CVE-2024-583676.5SurrealDB versions before 2.0.4 fail to properly enforce field permissions during SELECT, UPDATE, and DELETE operations, allowing authorized CVE-2024-583687.5SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API requests containing special characters. U CVE-2024-583696.5SurrealDB versions before 1.1.1 fail to properly validate invocation of custom parameters and functions at root or namespace levels, causing CVE-2024-58378.8Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially perform out of bounds memory access vi CVE-2024-583706.5SurrealDB versions before 1.1.0 fail to enforce recursion depth limits when parsing nested SurrealQL statements including IF, RELATE, and at CVE-2024-583747.5Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet endpoint that allows remote unauthenticate CVE-2024-583757.5OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation o CVE-2024-583766.7Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that a CVE-2024-583795.3nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set CVE-2024-58388.8Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to perform out of bounds memory access via a crafted CVE-2024-583806.5PocketMine-MP versions before 5.11.2 contain a denial of service vulnerability in BookEditPacket handling that crashes the server when an in