CVE-2024-58368CWE-248

CVE-2024-58368

High · published July 18, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
50.6
In the wild
Unconfirmed
What it is

SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API requests containing special characters. Unauthenticated attackers can send crafted HTTP requests with malformed header values to trigger an uncaught exception that crashes the server.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00653 · 50.6th percentile
Weakness
CWE-248 · Uncaught Exception
Published
2026-07-18T18:17Z
Affected products (1)
ProductVersionsFixed in
surrealdb/surrealdb< 1.1.01.1.0
References (2)
https://github.com/surrealdb/surrealdb/security/advisories/GHSA-m24x-r6q3-2vp9 · [email protected]https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-http-headers · [email protected]
EPSS history
Timeline
  • 18 JUL 13:10Z
    SurrealDB before 1.1.0 Denial of Service via HTTP Headers
    cvelistv5