CVE-2024-58357CWE-248

CVE-2024-58357

Medium · published July 18, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
38.1
In the wild
Unconfirmed
What it is

SurrealDB versions before 2.1.0 contain an uncaught exception vulnerability in the rand::time() function that panics when unwrap is called on a None result from timestamp_opt. Authorized clients can repeatedly invoke rand::time() to reliably trigger server panics and cause denial of service.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00450 · 38.1th percentile
Weakness
CWE-248 · Uncaught Exception
Published
2026-07-18T18:17Z
Affected products (1)
ProductVersionsFixed in
surrealdb/surrealdb< 2.1.02.1.0
References (2)
https://github.com/surrealdb/surrealdb/security/advisories/GHSA-h4f5-h82v-5w4r · [email protected]https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-rand-time · [email protected]
EPSS history
Timeline
  • 18 JUL 13:10Z
    SurrealDB before 2.1.0 Denial of Service via rand::time()
    cvelistv5