CVE-2024-58359: SurrealDB ORDER BY DoS Vulnerability

CVE-2024-58359 Overview

CVE-2024-58359 is a denial of service vulnerability in SurrealDB versions before 2.1.0. The flaw resides in the sorting mechanism used by the ORDER BY rand() clause. Authorized clients can submit queries containing ORDER BY rand() to trigger a panic in the sorting function, crashing the database server. The issue is categorized under [CWE-248] Uncaught Exception. Exploitation requires only low-privilege authenticated access and no user interaction, and it is exposed over the network.

Critical Impact
Any authenticated client can crash a SurrealDB instance with a single query, causing service disruption for all connected applications and users.

Affected Products

SurrealDB versions prior to 2.1.0
Deployments exposing SurrealDB query endpoints to authenticated users
Applications relying on SurrealDB for backend data services

Discovery Timeline

2026-07-18 - CVE-2024-58359 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2024-58359

Vulnerability Analysis

The vulnerability affects SurrealDB's query execution engine when handling the ORDER BY rand() sorting expression. The sorting function does not safely handle the randomized comparator values produced by rand(), resulting in a Rust panic that terminates the server process. Because SurrealDB is written in Rust, an uncaught panic in the sort routine propagates up the async runtime and crashes the database instance. Any authorized client with permission to execute queries can trigger the condition without elevated privileges.

Root Cause

The root cause is an unchecked runtime error [CWE-248] in the sorting comparator used to evaluate ORDER BY rand(). Randomized comparison values violate the strict weak ordering that stable sort algorithms require. When the comparator returns inconsistent results across invocations, the underlying sort implementation panics. SurrealDB versions before 2.1.0 did not wrap this operation in a fallible path, so the panic became a fatal condition for the server.

Attack Vector

An authenticated attacker sends a SurrealQL query containing an ORDER BY rand() clause against any accessible dataset. The query planner routes the request to the sort operator, which invokes the faulty comparator and panics. The panic terminates the SurrealDB process, disconnecting every client and interrupting in-flight transactions. A single malformed query is sufficient to induce the crash, and repeated submissions after restart sustain the outage. See the GitHub Security Advisory and the VulnCheck Advisory on SurrealDB for additional technical context.

Detection Methods for CVE-2024-58359

Indicators of Compromise

Unexpected SurrealDB process termination immediately after query execution
SurrealDB logs containing Rust panic traces referencing the sort or comparator functions
Sudden loss of client connections coinciding with ORDER BY rand() query submissions
Repeated automatic restarts of the SurrealDB service by an init system or orchestrator

Detection Strategies

Inspect SurrealDB query logs for ORDER BY rand() patterns issued by non-administrative accounts
Correlate service crash events with the last executed query for each session
Alert on Rust panic messages emitted by the SurrealDB process to stderr or the container log stream

Monitoring Recommendations

Monitor SurrealDB process uptime and restart counts through the container or systemd layer
Track authenticated query volume per account to identify anomalous query patterns
Forward SurrealDB logs to a centralized log platform and alert on panic signatures

How to Mitigate CVE-2024-58359

Immediate Actions Required

Upgrade SurrealDB to version 2.1.0 or later on all production and non-production instances
Audit user accounts with query privileges and revoke access from accounts that do not require it
Restrict network exposure of SurrealDB endpoints to trusted application tiers only

Patch Information

SurrealDB 2.1.0 addresses the panic by handling the randomized comparator condition safely within the sorting routine. Administrators should apply the upstream release published by the SurrealDB project. Deployment details and release notes are available in the GitHub Security Advisory.

Workarounds

Block or filter incoming queries containing ORDER BY rand() at the application layer before they reach SurrealDB
Enforce a query allowlist for client applications so ad-hoc sorting expressions cannot be submitted
Place SurrealDB behind a proxy that terminates sessions from accounts submitting panic-inducing queries

bash

# Configuration example
# Verify the running SurrealDB version and upgrade if it is below 2.1.0
surreal version

# Example upgrade using the official installer
curl -sSf https://install.surrealdb.com | sh

# Restart the service after upgrade
systemctl restart surrealdb