CVE-2024-58369: SurrealDB DoS Vulnerability

CVE-2024-58369 Overview

CVE-2024-58369 is a denial-of-service vulnerability affecting SurrealDB versions before 1.1.1. The database server fails to properly validate the invocation of custom parameters and functions when called at root or namespace scopes. Authorized clients can trigger an unhandled server panic by invoking these entities at unsupported levels, crashing the SurrealDB process. The flaw is classified under [CWE-248] (Uncaught Exception) and requires network access with low privileges. Successful exploitation results in loss of availability without impact to confidentiality or integrity.

Critical Impact
Any authenticated client can crash a SurrealDB server instance by issuing a single malformed invocation of a custom parameter or function at the root or namespace level.

Affected Products

SurrealDB versions prior to 1.1.1
Deployments exposing SurrealDB to authenticated network clients
Multi-tenant SurrealDB instances using root or namespace-scoped operations

Discovery Timeline

2026-07-18 - CVE-2024-58369 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2024-58369

Vulnerability Analysis

SurrealDB supports custom parameters (via DEFINE PARAM) and custom functions (via DEFINE FUNCTION) that are scoped to specific database contexts. The server code did not validate whether these entities were being invoked at a supported scope. When an authenticated client invoked a custom parameter or function at the root or namespace level, the server reached an unhandled code path and panicked. Rust panics in the SurrealDB process terminate the server, denying service to all connected tenants and clients. The vulnerability is remotely reachable through the standard query interface used by legitimate SurrealDB clients.

Root Cause

The root cause is missing scope validation before entity resolution. The server implementation assumed custom parameters and functions would only be invoked at the database level where they are supported. There is no defensive check that returns a structured error for invocations at root or namespace levels. Instead, the execution path reaches an assertion or unwrap call that panics under [CWE-248]. This design gap in input validation allows benign-looking queries to trigger a full-process crash.

Attack Vector

Exploitation requires network access to the SurrealDB endpoint and a valid authenticated session with permission to issue queries. The attacker connects to the server, selects the root or namespace context, and invokes any custom parameter or function reference at that scope. The invocation triggers the panic, and the server process exits. No user interaction is required and complexity is low. Because the crash affects the entire server, a single low-privileged client can disrupt all tenants sharing the instance. The vulnerability mechanism is described in the GitHub Security Advisory and the VulnCheck Advisory on SurrealDB.

No verified public proof-of-concept code is available. See the linked advisories for technical details on the vulnerable invocation pattern.

Detection Methods for CVE-2024-58369

Indicators of Compromise

Unexpected termination of the surreal server process with a Rust panic message in stdout or systemd journal logs.
Query logs showing custom parameter or function invocations issued while the active context is root or namespace scope.
Repeated client reconnect attempts following abrupt server shutdown on port 8000 or the configured SurrealDB port.

Detection Strategies

Alert on SurrealDB process crashes or restarts using service supervisors such as systemd, Kubernetes liveness probes, or container orchestrators.
Inspect query telemetry for statements referencing $param or custom function names issued outside a USE DB context.
Correlate authenticated session activity with server restart events to identify the source client and account.

Monitoring Recommendations

Ingest SurrealDB stdout, stderr, and audit logs into a centralized logging platform and alert on panic strings.
Track availability metrics for the SurrealDB endpoint and generate incidents on repeated unavailability within short windows.
Monitor authentication logs for accounts issuing queries immediately before crash events to identify potential abuse.

How to Mitigate CVE-2024-58369

Immediate Actions Required

Upgrade SurrealDB to version 1.1.1 or later on all server instances.
Restrict network access to the SurrealDB endpoint to trusted application clients only using firewall rules or private networking.
Review account permissions and revoke query privileges from any accounts that do not require them.
Enable automatic restart of the SurrealDB service to reduce downtime while patching is scheduled.

Patch Information

The fix is included in SurrealDB 1.1.1. Refer to the GitHub Security Advisory GHSA-jm4v-58r5-66hj for release notes and upgrade guidance. Operators running older 1.0.x builds should plan an upgrade path validated against their schema and client library versions.

Workarounds

Where immediate upgrade is not possible, avoid defining custom parameters or functions on instances exposed to less-trusted clients.
Place SurrealDB behind an authenticating proxy that filters queries invoking parameters or functions at root or namespace scope.
Configure the service manager to auto-restart the SurrealDB process on failure to limit outage duration until patching is completed.

bash

# Example: enforce automatic restart via systemd until patching completes
# /etc/systemd/system/surrealdb.service.d/override.conf
[Service]
Restart=always
RestartSec=2s