PT-2026-60941 · Surrealdb · Surrealdb

CVE-2024-58361 · Published 2026-07-18 · Updated 2026-07-18

NVD

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SurrealDB versions before 2.0.4 contain an uncaught exception handling vulnerability in the parser error rendering code when processing empty strings. Authorized clients can execute malformed queries with empty string conversions to record, duration, or datetime types that cause a panic in error rendering, crashing the server.

Fix

Weakness Enumeration

CWE-248

Related Identifiers

CVE-2024-58361

Affected Products

Surrealdb

References · 3

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-qjrv-v6qp-x99x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-58361 · Security Note
• https://vulncheck.com/advisories/surrealdb-before-denial-of-service-via-parser-exception · Note