CVE-2024-58369

SurrealDB versions before 1.1.1 fail to properly validate invocation of custom parameters and functions at root or namespace levels, causing server panic. Authorized clients can invoke these entities at unsupported levels to crash the SurrealDB server, resulting in denial of service.

CVSS 4.0

7.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

0.4% chance of exploitation in the next 30 days; higher than 38% of CVEs (scores of 2026-10-27)

CWE

CWE-248

Published

2026-07-18

Modified

2026-10-27

Record from

the NVD, synced 2026-10-27

Affected

• surrealdb:surrealdb

Packages (OSV)

References

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-jm4v-58r5-66hj
• https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-global-parameters

Check your stackJSON