CVE-2024-58365CWE-248

CVE-2024-58365

Medium · published July 18, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
38.1
In the wild
Unconfirmed
What it is

SurrealDB versions before 1.2.0 contain an uncaught exception vulnerability in the query executor when processing calls to nonexistent built-in functions. Authorized clients can craft pre-parsed queries invoking nonexistent functions to trigger a panic that crashes the server.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00450 · 38.1th percentile
Weakness
CWE-248 · Uncaught Exception
Published
2026-07-18T18:17Z
Affected products (1)
ProductVersionsFixed in
surrealdb/surrealdb< 1.2.01.2.0
References (2)
https://github.com/surrealdb/surrealdb/security/advisories/GHSA-6wr5-jmpr-mjcx · [email protected]https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-nonexistent-function · [email protected]
EPSS history
Timeline
  • 18 JUL 13:10Z
    SurrealDB before 1.2.0 Denial of Service via Nonexistent Function
    cvelistv5