CVE-2024-58369CWE-248

CVE-2024-58369

Medium · published July 18, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
38.1
In the wild
Unconfirmed
What it is

SurrealDB versions before 1.1.1 fail to properly validate invocation of custom parameters and functions at root or namespace levels, causing server panic. Authorized clients can invoke these entities at unsupported levels to crash the SurrealDB server, resulting in denial of service.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00450 · 38.1th percentile
Weakness
CWE-248 · Uncaught Exception
Published
2026-07-18T18:17Z
Affected products (1)
ProductVersionsFixed in
surrealdb/surrealdb< 1.1.11.1.1
References (2)
https://github.com/surrealdb/surrealdb/security/advisories/GHSA-jm4v-58r5-66hj · [email protected]https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-global-parameters · [email protected]
EPSS history
Timeline
  • 18 JUL 13:10Z
    SurrealDB before 1.1.1 Denial of Service via Global Parameters
    cvelistv5