CVE-2024-58364: SurrealDB before 1.2.1 Denial of Service via Parsing Error
SurrealDB versions before 1.2.1 contain an uncaught exception handling vulnerability in span rendering when parsing queries with errors on line terminator characters. Authorized clients can submit malformed queries that trigger a panic in the span rendering code, crashing the server and causing denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SurrealDBto a version that resolves this vulnerability.Fixed in 1.2.1 - Compensating control
Apply a temporary access restriction to the SurrealDB service so that only trusted/authorized clients can reach the query/ingestion endpoint until SurrealDB is upgraded to 1.2.1 or later.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-58364?
The severity of CVE-2024-58364 is medium, rated at 6.5.
What type of vulnerability is CVE-2024-58364?
CVE-2024-58364 is a Denial of Service (DoS) vulnerability due to a parsing error in SurrealDB.
How do I fix CVE-2024-58364?
To fix CVE-2024-58364, upgrade SurrealDB to version 1.2.1 or later.
What can exploit CVE-2024-58364?
CVE-2024-58364 can be exploited by authorized clients submitting malformed queries that trigger a panic.
What version of SurrealDB is affected by CVE-2024-58364?
SurrealDB versions before 1.2.1 are affected by CVE-2024-58364.