CVE-2024-58370: SurrealDB DoS Vulnerability

CVE-2024-58370 Overview

CVE-2024-58370 is an uncontrolled recursion vulnerability [CWE-674] in SurrealDB versions prior to 1.1.0. The database engine fails to enforce depth limits when parsing nested SurrealQL statements. Affected constructs include IF statements, RELATE statements, and attribute access idioms. Authenticated attackers can submit deeply nested queries that exhaust the parser stack. The resulting stack overflow crashes the SurrealDB server process and disrupts service availability for all connected clients.

Critical Impact
Authenticated remote attackers can crash SurrealDB instances by submitting SurrealQL queries with excessive nesting depth, causing a denial-of-service condition against database availability.

Affected Products

SurrealDB versions prior to 1.1.0
SurrealQL parser components handling IF statements
SurrealQL parser components handling RELATE statements and attribute access idioms

Discovery Timeline

2026-07-18 - CVE-2024-58370 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2024-58370

Vulnerability Analysis

SurrealDB parses SurrealQL statements using a recursive descent approach. Several grammar rules invoke themselves during nested expression handling without any depth counter or limit check. An attacker who can authenticate to the database can send a single query containing thousands of nested IF blocks, RELATE clauses, or chained attribute accesses. Each nesting level consumes additional native stack space. When the process stack is exhausted, the operating system terminates the SurrealDB server with a segmentation fault. Because SurrealQL parsing occurs before query authorization for statement structure, minimally privileged accounts can trigger the crash.

Root Cause

The root cause is missing recursion depth enforcement in the SurrealQL parser. The vulnerability is categorized under CWE-674: Uncontrolled Recursion. Parsing routines for nested grammar productions lack a bounded counter to reject inputs beyond a safe threshold. SurrealDB 1.1.0 introduces explicit depth limits in the affected parser paths.

Attack Vector

Exploitation requires network access to the SurrealDB endpoint and valid authentication credentials with low privileges. The attacker submits a crafted SurrealQL statement containing deeply nested syntactic elements over any supported protocol interface. No user interaction is required beyond query submission. The affected server terminates immediately upon parsing the malicious input, denying service to all tenants sharing that instance. See the GitHub Security Advisory and the VulnCheck Denial of Service Advisory for advisory details.

Detection Methods for CVE-2024-58370

Indicators of Compromise

Unexpected SurrealDB process termination or restart events accompanied by stack overflow signals in system logs.
Inbound SurrealQL queries containing anomalously high counts of nested IF, RELATE, or attribute access tokens.
Repeated connection resets or query timeouts from a single authenticated session immediately preceding a service outage.

Detection Strategies

Inspect SurrealQL query payloads at ingress and flag statements whose bracket, IF, or RELATE nesting depth exceeds a defined threshold.
Correlate database process crashes with the last query submitted by each session to identify malicious clients.
Monitor authentication logs for low-privilege accounts issuing malformed or unusually large queries.

Monitoring Recommendations

Forward SurrealDB stdout, stderr, and systemd journal entries to a centralized log platform such as Singularity Data Lake for correlation with authentication and network telemetry.
Alert on repeated SIGSEGV or abnormal exit codes from the surreal process within short time windows.
Track query length and structural complexity metrics per authenticated principal to identify abuse patterns.

How to Mitigate CVE-2024-58370

Immediate Actions Required

Upgrade SurrealDB to version 1.1.0 or later on all production, staging, and development instances.
Audit accounts with database access and revoke credentials that do not require SurrealQL execution privileges.
Restrict network exposure of SurrealDB endpoints to trusted application subnets using firewall rules.

Patch Information

SurrealDB 1.1.0 introduces recursion depth enforcement in the SurrealQL parser for IF, RELATE, and attribute access idioms. Operators should apply the upgrade following the release notes in the GitHub Security Advisory GHSA-6r8p-hpg7-825g. Verify the running binary version with surreal version after deployment.

Workarounds

Place a query-inspecting proxy in front of SurrealDB to reject statements whose nesting depth exceeds an operationally safe limit.
Run SurrealDB under a process supervisor that automatically restarts the service on crash to reduce outage duration until patching completes.
Limit issued authentication tokens to trusted internal services and remove any unused or shared credentials.

bash

# Configuration example: upgrade and verify SurrealDB
# Pull the patched release
docker pull surrealdb/surrealdb:1.1.0

# Restart the service using the patched image
docker stop surrealdb && docker rm surrealdb
docker run -d --name surrealdb \
  -p 8000:8000 \
  surrealdb/surrealdb:1.1.0 \
  start --auth --user root --pass "$SURREAL_ROOT_PASS"

# Confirm the running version
docker exec surrealdb surreal version