CVE-2024-58368: SurrealDB before 1.1.0 Denial of Service via HTTP Headers
SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API requests containing special characters. Unauthenticated attackers can send crafted HTTP requests with malformed header values to trigger an uncaught exception that crashes the server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SurrealDBto a version that resolves this vulnerability.Fixed in 1.1.0
Event History
Frequently Asked Questions
What is the severity of CVE-2024-58368?
The severity of CVE-2024-58368 is categorized as high with a score of 7.5.
How do I fix CVE-2024-58368?
To fix CVE-2024-58368, upgrade SurrealDB to version 1.1.0 or later.
What type of vulnerability is CVE-2024-58368?
CVE-2024-58368 is a Denial of Service vulnerability that affects SurrealDB.
Who can exploit CVE-2024-58368?
Unauthenticated attackers can exploit CVE-2024-58368 by sending crafted HTTP requests.
What impact does CVE-2024-58368 have on SurrealDB?
CVE-2024-58368 can result in the server crashing due to uncaught exceptions triggered by malformed HTTP headers.