CVE-2024-58361 affects SurrealDB versions prior to 2.0.4. The vulnerability arises from an uncaught exception in the parser's error rendering logic when handling empty strings converted to record, duration, or datetime types. This can be exploited by authorized clients to execute malformed queries that cause the server to panic and crash, resulting in a denial of service condition. The issue is categorized under CWE-248 (Uncaught Exception).

An attacker with authorized access can cause the SurrealDB server to crash by sending specially crafted malformed queries involving empty string conversions. This results in a denial of service due to server panic during error rendering. There is no indication of data breach or privilege escalation from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict query inputs to prevent malformed empty string conversions or limit access to trusted clients to reduce risk of exploitation.