Surrealdb: Duplicate Advisory: Uncaught Exception in Macro Expecting Native Function to Exist

CVE-2024-58365 affects SurrealDB versions prior to 1.2.0. The vulnerability arises from the query executor not handling calls to nonexistent native functions properly, resulting in an uncaught exception that crashes the server. Authorized users can exploit this by crafting pre-parsed queries invoking these nonexistent functions, triggering a denial of service condition. The vulnerability has a CVSS v3.1 score of 6.5, indicating a high severity primarily due to availability impact. There is no indication of data compromise or integrity loss. This advisory is a duplicate of GHSA-6wr5-jmpr-mjcx and has been withdrawn to preserve references.

The vulnerability allows authorized clients to cause a server crash by invoking nonexistent built-in functions in queries, resulting in denial of service. There is no impact on confidentiality or integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this advisory is a duplicate and no patch links are provided, users should monitor official SurrealDB advisories for updates and apply any official fixes once available. Until then, restricting query inputs to prevent calls to nonexistent functions may reduce risk.