Uncaught Exception Handling Vulnerability in SurrealDB by SurrealDB Vendor

CVE-2024-58361

What is CVE-2024-58361?

SurrealDB versions prior to 2.0.4 are susceptible to an uncaught exception handling vulnerability found in the parser error rendering code. This issue arises when processing empty strings, which can be manipulated by authorized clients to execute malformed queries. Conversions to record, duration, or datetime types using empty strings can trigger a panic in the error rendering process, resulting in a server crash. This flaw poses a significant risk, enabling potential downtime for the affected instances.

References