CVE-2024-58361 Overview
CVE-2024-58361 is a denial of service vulnerability affecting SurrealDB versions before 2.0.4. The flaw resides in the parser error rendering code, which fails to handle empty strings correctly during type conversion. Authorized clients can submit malformed queries that convert empty strings to record, duration, or datetime types, triggering an uncaught exception. The resulting panic crashes the database server, disrupting availability for all connected applications and users. The weakness is classified as [CWE-248] Uncaught Exception, with an EPSS score of 0.249%.
Critical Impact
An authenticated attacker can crash SurrealDB instances remotely by submitting a single malformed query, causing service-wide downtime.
Affected Products
- SurrealDB versions prior to 2.0.4
Discovery Timeline
- 2026-07-18 - CVE-2024-58361 published to NVD
- 2026-07-21 - Last updated in NVD database
Technical Details for CVE-2024-58361
Vulnerability Analysis
The vulnerability exists in SurrealDB's query parser error rendering logic. When the parser encounters a type conversion failure, it constructs a diagnostic message that references the offending input. If that input is an empty string, the rendering routine attempts operations that assume a non-zero length. This assumption causes an uncaught exception and a runtime panic in the server process.
The panic is not confined to the offending query. Because the exception propagates outside the request handler, the entire SurrealDB server process terminates. All active sessions are dropped and pending transactions are interrupted. Any client with valid authentication and query privileges can trigger the condition.
Root Cause
The root cause is missing input validation in the parser error rendering path, categorized as [CWE-248] Uncaught Exception. The code assumes that any string reaching the type conversion error handler contains at least one character. Empty string operands for record, duration, and datetime conversions bypass this implicit contract and produce an unrecoverable state.
Attack Vector
Exploitation requires network access to the SurrealDB endpoint and valid credentials with query execution rights. The attacker submits a query containing an empty string cast to one of the affected types. The parser attempts to render the error, panics, and the server terminates. See the GitHub Security Advisory and the VulnCheck Advisory for technical details on the affected code paths.
Detection Methods for CVE-2024-58361
Indicators of Compromise
- Unexpected termination of the surreal server process without an orderly shutdown log entry.
- Panic traces in SurrealDB logs referencing parser error rendering functions.
- Repeated client reconnection attempts following abrupt session drops.
Detection Strategies
- Monitor SurrealDB process supervisor events for repeated crash-restart cycles within short intervals.
- Inspect query audit logs for casts of empty string literals to record, duration, or datetime types.
- Correlate authenticated client sessions with server crash timestamps to identify the originating account.
Monitoring Recommendations
- Alert on SurrealDB service restarts through systemd, Kubernetes liveness probes, or container orchestrators.
- Forward SurrealDB stderr and panic output to a centralized logging system for anomaly detection.
- Track query error rates per authenticated principal and flag accounts producing parser exceptions.
How to Mitigate CVE-2024-58361
Immediate Actions Required
- Upgrade all SurrealDB instances to version 2.0.4 or later.
- Audit and rotate credentials for accounts with query execution privileges on exposed instances.
- Restrict network exposure of SurrealDB endpoints to trusted application tiers only.
Patch Information
The issue is fixed in SurrealDB 2.0.4. Refer to the GitHub Security Advisory GHSA-qjrv-v6qp-x99x for the patched release and remediation guidance.
Workarounds
- Apply least-privilege principles by revoking query permissions from service accounts that do not require them.
- Place SurrealDB behind an application-layer proxy that filters or rejects queries containing empty-string type casts.
- Configure the process supervisor to auto-restart the server, reducing outage duration until patching is complete.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
