Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

SurrealDB: Untrusted clients can crash the server using random sorting

CVE-2024-58359 · published 3 months ago
Summary

An unauthorized client can crash a SurrealDB server by running a specific query that sorts data randomly, leading to a denial of service. To fix this, update to SurrealDB version 2.1.0 or later. If you can't upgrade, limit untrusted clients' access to SurrealDB and set up automatic server restarts to minimize downtime.

What to do
  • Update tobiemh surrealdb to version 2.1.0.
  • Update tobiemh surrealdb-core to version 2.1.0.
  • Update surrealdb surrealdb to version 2.1.0 or later.
Affected software
Ecosystem VendorProductAffected versions
rust tobiemh surrealdb < 2.1.0
Fix: upgrade to 2.1.0
rust tobiemh surrealdb-core < 2.1.0
Fix: upgrade to 2.1.0
– surrealdb surrealdb < 2.1.0
Original advisory text
SurrealDB before 2.1.0 Denial of Service via rand() Sorting
SurrealDB versions before 2.1.0 contain a denial of service vulnerability in the sorting mechanism when using ORDER BY rand() clause. Authorized clients can execute queries with ORDER BY rand() to trigger a panic in the sorting function, crashing the server.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-248Uncaught Exception
Timeline
Published18 Jul 2026
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-m52v-24p8-654f · GHSA
CVE-2024-58359 · OSV
CVE-2024-58359 · NVD
CVE-2024-58359 · MITRE
Track software like this
Free during beta