CVE-2024-58365 Overview
CVE-2024-58365 is a denial of service vulnerability in SurrealDB versions before 1.2.0. The query executor fails to handle calls to nonexistent built-in functions, resulting in an uncaught exception that panics the process. Authorized clients can craft pre-parsed queries that reference undefined functions and crash the database server. The flaw is tracked under CWE-248: Uncaught Exception and requires low-privileged authenticated network access. Exploitation impacts availability only, with no impact on confidentiality or integrity.
Critical Impact
Any authenticated SurrealDB client can crash the database server by submitting a pre-parsed query that invokes a nonexistent built-in function, causing service outage.
Affected Products
- SurrealDB versions prior to 1.2.0
- SurrealDB server deployments accepting authenticated client queries
- Applications embedding SurrealDB as a query backend
Discovery Timeline
- 2026-07-18 - CVE-2024-58365 published to NVD
- 2026-07-21 - Last updated in NVD database
Technical Details for CVE-2024-58365
Vulnerability Analysis
SurrealDB exposes a query language with a set of built-in functions resolved at execution time. When a client submits a pre-parsed query that references a function name not present in the built-in registry, the executor does not gracefully return an error. Instead, the code path reaches an unhandled panic and terminates the server process. Because the parser stage is bypassed by pre-parsed queries, function-name validation that might occur during parsing is not enforced. The result is an availability failure that requires only a single malformed request per crash.
Root Cause
The root cause is an uncaught exception in the query execution path. The function-dispatch logic assumes any function name reaching the executor has been validated. When that assumption fails, the code invokes a lookup that panics rather than returning a structured error to the client. This maps directly to CWE-248, where exceptional conditions are not properly handled within the operational boundary of the process.
Attack Vector
Exploitation requires network access and valid credentials at any privilege level. An authorized client crafts a pre-parsed query containing a call to a function that does not exist in the SurrealDB built-in set. Submitting the query over any supported protocol interface triggers the panic. The server terminates, disconnecting all active sessions until the process is restarted. Repeated submission after restart sustains the denial of service.
No verified proof-of-concept code is available. See the GitHub Security Advisory GHSA-6wr5-jmpr-mjcx and the VulnCheck Advisory for vendor-supplied details.
Detection Methods for CVE-2024-58365
Indicators of Compromise
- Unexpected SurrealDB process termination immediately following a client query submission.
- Panic messages in SurrealDB stderr or systemd journal referencing function resolution or dispatch.
- Repeated client reconnection attempts correlated with server restarts by a process supervisor.
- Authenticated sessions submitting pre-parsed queries containing unknown function identifiers.
Detection Strategies
- Parse SurrealDB logs for panic stack traces and correlate timestamps with the last received query.
- Monitor process supervisors (systemd, Kubernetes, Docker) for unexpected restart events on database workloads.
- Ingest SurrealDB query audit logs into a SIEM and alert on queries referencing function names outside the documented built-in set.
Monitoring Recommendations
- Track database uptime and restart count as a service-level indicator with alerting on deviation.
- Rate-limit or flag authenticated identities that trigger repeated abnormal server terminations.
- Retain query logs long enough to reconstruct the request sequence preceding any crash event.
How to Mitigate CVE-2024-58365
Immediate Actions Required
- Upgrade all SurrealDB instances to version 1.2.0 or later.
- Audit authenticated accounts and revoke credentials that are no longer required.
- Restrict network exposure of SurrealDB endpoints to trusted application tiers only.
- Ensure a process supervisor is configured to restart the database after a crash while investigation is underway.
Patch Information
SurrealDB resolved this issue in version 1.2.0. Refer to the GitHub Security Advisory GHSA-6wr5-jmpr-mjcx for the official fix reference. Upgrading is the only complete remediation because the flaw resides in the query executor itself.
Workarounds
- Limit database credentials to trusted application service accounts and disable interactive user access.
- Terminate network paths that allow untrusted clients to reach the SurrealDB listener.
- Front the database with an application layer that validates queries against an allowlist of known function names before forwarding.
# Verify installed SurrealDB version and upgrade if below 1.2.0
surreal version
# Example upgrade using the official installer
curl -sSf https://install.surrealdb.com | sh
# Restart the service after upgrade
systemctl restart surrealdb
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
