CVE-2024-58370: SurrealDB before 1.1.0 Uncontrolled Recursion Denial of Service
SurrealDB versions before 1.1.0 fail to enforce recursion depth limits when parsing nested SurrealQL statements including IF, RELATE, and attribute access idioms. Authorized attackers can submit queries with excessive nesting depth to cause stack overflow and crash the server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SurrealDBto a version that resolves this vulnerability.Fixed in 1.1.0 - Compensating control
Apply a temporary mitigation by restricting access so that only trusted/authorized clients can submit SurrealQL queries that could trigger excessive nesting depth.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-58370?
CVE-2024-58370 has a medium severity rating of 6.5.
How do I fix CVE-2024-58370?
To fix CVE-2024-58370, upgrade SurrealDB to version 1.1.0 or later.
What is CVE-2024-58370?
CVE-2024-58370 is a vulnerability in SurrealDB that allows for uncontrolled recursion leading to a denial of service.
What can an attacker do with CVE-2024-58370?
An authorized attacker can exploit CVE-2024-58370 by submitting overly nested SurrealQL statements, causing a server crash.
Which versions of SurrealDB are affected by CVE-2024-58370?
SurrealDB versions before 1.1.0 are affected by CVE-2024-58370.