CVE-2024-58370CWE-674

CVE-2024-58370

Medium · published July 18, 2026

CVSS v3.1

6.5

EPSS

Percentile

41.0

In the wild

Unconfirmed

What it is

SurrealDB versions before 1.1.0 fail to enforce recursion depth limits when parsing nested SurrealQL statements including IF, RELATE, and attribute access idioms. Authorized attackers can submit queries with excessive nesting depth to cause stack overflow and crash the server.

The record

Technical detail

CVSS v3.1: 6.5 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0: Not supplied
EPSS: 0.00487 · 41.0th percentile
Weakness: CWE-674 · Uncontrolled Recursion
Published: 2026-07-18T18:17Z

Affected products (1)

Product	Versions	Fixed in
surrealdb/surrealdb	< 1.1.0	1.1.0

References (2)

https://github.com/surrealdb/surrealdb/security/advisories/GHSA-6r8p-hpg7-825g · [email protected]https://www.vulncheck.com/advisories/surrealdb-before-uncontrolled-recursion-denial-of-service · [email protected]

EPSS history

Timeline

18 JUL 13:10Z
SurrealDB before 1.1.0 Uncontrolled Recursion Denial of Service
cvelistv5