CVE-2024-58361

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-58361
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-58361.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-58361
Aliases
Published
2026-07-18T13:10:03.607Z
Modified
2026-07-20T03:45:15.450555263Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
SurrealDB before 2.0.4 Denial of Service via Parser Exception
Details

SurrealDB versions before 2.0.4 contain an uncaught exception handling vulnerability in the parser error rendering code when processing empty strings. Authorized clients can execute malformed queries with empty string conversions to record, duration, or datetime types that cause a panic in error rendering, crashing the server.

Database specific 
{
    "cwe_ids": [
        "CWE-248"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/58xxx/CVE-2024-58361.json",
    "cna_assigner": "VulnCheck"
}
References

Affected packages

Git / github.com/surrealdb/surrealdb

Affected ranges

Type
GIT
Repo
https://github.com/surrealdb/surrealdb
Events
Introduced
c382fa158dc84b329328606f663efe574f102a7d
Fixed
f43a062c1ad7d346f1e2454ebd23d0ea6094db98
Database specific 
{
    "extracted_events": [
        {
            "introduced": "2.0.0"
        },
        {
            "fixed": "2.0.4"
        },
        {
            "introduced": "0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

v2.*
v2.0.0
v2.0.1
v2.0.2
v2.0.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-58361.json"