SurrealDB versions before 1.2.1 contain an uncaught exception handling vulnerability in span rendering when parsing queries with errors on line… (CVE-2024-58364)
SurrealDB versions before 1.2.1 contain an uncaught exception handling vulnerability in span rendering when parsing queries with errors on line terminator characters. Authorized clients can submit malformed queries that trigger a panic in the span rendering code, crashing the server and causing denial of service.
AI Analysis
Technical Summary
CVE-2024-58364 describes an uncaught exception handling vulnerability in SurrealDB prior to version 1.2.1. When parsing queries with errors involving line terminator characters, the span rendering code panics, crashing the server. This allows authorized clients to cause a denial of service by submitting malformed queries that trigger this panic. The vulnerability is classified under CWE-248 (Uncaught Exception). No patch links or vendor advisories are provided, and the affected versions are not explicitly stated but implied to be all versions before 1.2.1.
Potential Impact
The vulnerability allows authorized clients to crash the SurrealDB server by submitting malformed queries, causing denial of service. There is no indication of data breach, privilege escalation, or remote code execution. The impact is limited to availability disruption of the database service.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is referenced, users should monitor vendor communications for updates. Until a fix is available, restricting query inputs and limiting authorized client capabilities may reduce exposure.
SurrealDB versions before 1.2.1 contain an uncaught exception handling vulnerability in span rendering when parsing queries with errors on line… (CVE-2024-58364)
Description
SurrealDB versions before 1.2.1 contain an uncaught exception handling vulnerability in span rendering when parsing queries with errors on line terminator characters. Authorized clients can submit malformed queries that trigger a panic in the span rendering code, crashing the server and causing denial of service.
CVSS v4.0
Affected software
pkg:github/surrealdb/surrealdbRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2024-58364 describes an uncaught exception handling vulnerability in SurrealDB prior to version 1.2.1. When parsing queries with errors involving line terminator characters, the span rendering code panics, crashing the server. This allows authorized clients to cause a denial of service by submitting malformed queries that trigger this panic. The vulnerability is classified under CWE-248 (Uncaught Exception). No patch links or vendor advisories are provided, and the affected versions are not explicitly stated but implied to be all versions before 1.2.1.
Potential Impact
The vulnerability allows authorized clients to crash the SurrealDB server by submitting malformed queries, causing denial of service. There is no indication of data breach, privilege escalation, or remote code execution. The impact is limited to availability disruption of the database service.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is referenced, users should monitor vendor communications for updates. Until a fix is available, restricting query inputs and limiting authorized client capabilities may reduce exposure.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-cqmh-qfgq-fxf4
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2024-58364"]
- Ecosystems
- []
- Database Specific Severity
- HIGH
- Cvss Version
- 4.0
Threat ID: 6a5ba17f44ab8fbf7c789e91
Added to database: 07/18/2026, 15:53:35 UTC
Last enriched: 07/18/2026, 16:23:54 UTC
Last updated: 07/18/2026, 19:35:35 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.