PT-2026-60948 · Surrealdb · Surrealdb

Tu0Laj1 · CVE-2024-58368 · Published 2026-07-18 · Updated 2026-07-18

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 1.1.0

Description An issue exists where the server fails to properly parse the ID, DB, and NS headers in HTTP REST API requests that contain special characters. Unauthenticated attackers can send crafted HTTP requests with malformed header values to trigger an uncaught exception, resulting in a denial of service by crashing the server.

Recommendations Update to version 1.1.0 or later.

Fix

DoS

Weakness Enumeration

CWE-248

Related Identifiers

CVE-2024-58368

Affected Products

Surrealdb

References · 4

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-m24x-r6q3-2vp9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-58368 · Security Note
• https://vulncheck.com/advisories/surrealdb-before-denial-of-service-via-http-headers · Note
• https://twitter.com/VulmonFeeds/status/2078533278139666845 · Twitter Post