PT-2026-60950 · Surrealdb · Surrealdb

CVE-2024-58370 · Published 2026-07-18 · Updated 2026-07-18

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 1.1.0

Description The software fails to enforce recursion depth limits when parsing nested SurrealQL statements, specifically involving IF, RELATE, and attribute access idioms. Authorized attackers can submit queries with excessive nesting depth to trigger a stack overflow, which leads to a server crash.

Recommendations Update to version 1.1.0 or later.

Fix

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

CVE-2024-58370

Affected Products

Surrealdb

References · 4

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-6r8p-hpg7-825g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-58370 · Security Note
• https://vulncheck.com/advisories/surrealdb-before-uncontrolled-recursion-denial-of-service · Note
• https://twitter.com/VulmonFeeds/status/2078512790927470783 · Twitter Post