CVE-2024-58361CWE-248

CVE-2024-58361

Medium · published July 18, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
38.1
In the wild
Unconfirmed
What it is

SurrealDB versions before 2.0.4 contain an uncaught exception handling vulnerability in the parser error rendering code when processing empty strings. Authorized clients can execute malformed queries with empty string conversions to record, duration, or datetime types that cause a panic in error rendering, crashing the server.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00450 · 38.1th percentile
Weakness
CWE-248 · Uncaught Exception
Published
2026-07-18T18:17Z
Affected products (1)
ProductVersionsFixed in
surrealdb/surrealdb≥ 2.0.0, < 2.0.42.0.4
References (2)
https://github.com/surrealdb/surrealdb/security/advisories/GHSA-qjrv-v6qp-x99x · [email protected]https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-parser-exception · [email protected]
EPSS history
Timeline
  • 18 JUL 13:10Z
    SurrealDB before 2.0.4 Denial of Service via Parser Exception
    cvelistv5