CVE-2024-58359CWE-248

CVE-2024-58359

Medium · published July 18, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
38.1
In the wild
Unconfirmed
What it is

SurrealDB versions before 2.1.0 contain a denial of service vulnerability in the sorting mechanism when using ORDER BY rand() clause. Authorized clients can execute queries with ORDER BY rand() to trigger a panic in the sorting function, crashing the server.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00450 · 38.1th percentile
Weakness
CWE-248 · Uncaught Exception
Published
2026-07-18T18:17Z
Affected products (1)
ProductVersionsFixed in
surrealdb/surrealdb< 2.1.02.1.0
References (2)
https://github.com/surrealdb/surrealdb/security/advisories/GHSA-m52v-24p8-654f · [email protected]https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-rand-sorting · [email protected]
EPSS history
Timeline
  • 18 JUL 13:10Z
    SurrealDB before 2.1.0 Denial of Service via rand() Sorting
    cvelistv5