CVE-2024-58364CWE-248

CVE-2024-58364

Medium · published July 18, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
38.1
In the wild
Unconfirmed
What it is

SurrealDB versions before 1.2.1 contain an uncaught exception handling vulnerability in span rendering when parsing queries with errors on line terminator characters. Authorized clients can submit malformed queries that trigger a panic in the span rendering code, crashing the server and causing denial of service.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00450 · 38.1th percentile
Weakness
CWE-248 · Uncaught Exception
Published
2026-07-18T18:17Z
Affected products (1)
ProductVersionsFixed in
surrealdb/surrealdb< 1.2.11.2.1
References (2)
https://github.com/surrealdb/surrealdb/security/advisories/GHSA-8xff-473h-f863 · [email protected]https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-parsing-error · [email protected]
EPSS history
Timeline
  • 18 JUL 13:10Z
    SurrealDB before 1.2.1 Denial of Service via Parsing Error
    cvelistv5