CVE-2024-58368: SurrealDB DoS Vulnerability

CVE-2024-58368 Overview

CVE-2024-58368 is a denial-of-service vulnerability in SurrealDB versions before 1.1.0. The database server fails to properly parse the ID, DB, and NS headers in HTTP REST API requests when they contain special characters. Unauthenticated remote attackers can send crafted HTTP requests with malformed header values, triggering an uncaught exception that crashes the server process.

The flaw is categorized under [CWE-248] Uncaught Exception. It requires no authentication, no user interaction, and can be exercised over the network against any exposed SurrealDB HTTP endpoint.

Critical Impact
Unauthenticated attackers can crash SurrealDB instances remotely by sending HTTP requests with malformed ID, NS, or DB header values, leading to service outage and potential data availability loss.

Affected Products

SurrealDB versions prior to 1.1.0
SurrealDB HTTP REST API endpoints
Any application or service exposing SurrealDB HTTP interfaces to untrusted networks

Discovery Timeline

2026-07-18 - CVE-2024-58368 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2024-58368

Vulnerability Analysis

SurrealDB exposes an HTTP REST API that accepts several custom headers to specify session context, including ID for the request identifier, NS for the namespace, and DB for the database name. In versions prior to 1.1.0, the header parsing logic does not validate or sanitize special characters before processing these values.

When a malformed value reaches downstream parsing routines, the code path raises an exception that propagates uncaught to the server's request handling layer. The unhandled exception terminates the server process rather than returning an HTTP error response to the client.

Because the HTTP REST API is often exposed on the network for application backends, the attack surface extends beyond localhost deployments. A single crafted request is sufficient to take the database offline until it is manually or automatically restarted.

Root Cause

The root cause is missing input validation combined with an uncaught exception in the header parsing routines. SurrealDB assumed that header values conformed to expected character sets, so no defensive error handling wrapped the parsing logic. Any parsing failure propagates up the call stack and terminates the server.

Attack Vector

The attack vector is network-based and requires no authentication. An attacker crafts an HTTP request to any SurrealDB REST endpoint and includes a value with special characters in the ID, NS, or DB header. On receipt, the server attempts to parse the header, encounters the invalid input, and crashes. Repeated requests after service restart can sustain a denial-of-service condition.

Detailed technical information is available in the GitHub Security Advisory GHSA-m24x-r6q3-2vp9 and the VulnCheck Advisory on SurrealDB.

Detection Methods for CVE-2024-58368

Indicators of Compromise

Unexpected SurrealDB process crashes or restarts correlated with inbound HTTP requests
HTTP requests to SurrealDB endpoints containing non-printable or unusual special characters in ID, NS, or DB headers
Gaps in query logs immediately following inbound REST API requests from untrusted sources
Repeated TCP connection resets from clients after issuing REST API calls

Detection Strategies

Inspect HTTP access logs and reverse-proxy logs for requests carrying ID, NS, or DB headers with control characters, encoded bytes, or non-ASCII input
Correlate SurrealDB process exit events with the timestamp of the last received HTTP request to identify crash-triggering payloads
Deploy web application firewall rules that flag or block requests containing suspicious characters in these header fields

Monitoring Recommendations

Alert on SurrealDB service restart events and unexpected process termination
Monitor for spikes in 5xx responses or connection failures on the SurrealDB HTTP port
Track the source IP addresses of clients whose requests immediately precede a service crash for potential blocklisting

How to Mitigate CVE-2024-58368

Immediate Actions Required

Upgrade SurrealDB to version 1.1.0 or later on all affected instances
Restrict network exposure of the SurrealDB HTTP REST API to trusted application backends only
Place SurrealDB behind a reverse proxy or WAF that validates HTTP header content before forwarding
Enable process supervision so that any crash is automatically recovered while investigation proceeds

Patch Information

The SurrealDB maintainers addressed the issue in version 1.1.0 by adding proper validation and exception handling for the ID, NS, and DB HTTP headers. Refer to the GitHub Security Advisory GHSA-m24x-r6q3-2vp9 for the fix commit and release notes.

Workarounds

Terminate the SurrealDB HTTP REST API behind a reverse proxy configured to reject headers containing control characters or non-ASCII bytes
Enforce strict allow-list validation for the ID, NS, and DB headers at the proxy layer, permitting only alphanumeric identifiers
Restrict access to the SurrealDB HTTP port via firewall rules so only known application servers can reach the endpoint
Configure a service manager such as systemd with automatic restart to reduce downtime while patches are applied

bash

# Example: reject requests with suspicious NS/DB/ID headers at nginx
map $http_ns $ns_invalid { default 0; "~[^A-Za-z0-9_-]" 1; }
map $http_db $db_invalid { default 0; "~[^A-Za-z0-9_-]" 1; }
map $http_id $id_invalid { default 0; "~[^A-Za-z0-9_-]" 1; }

server {
    listen 443 ssl;
    location / {
        if ($ns_invalid) { return 400; }
        if ($db_invalid) { return 400; }
        if ($id_invalid) { return 400; }
        proxy_pass http://surrealdb_backend;
    }
}