SurrealDB (< 1.1.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/surrealdb--1.1.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 18 Jul 2026 14:21:36 +0000CVE-2024-58368: SurrealDB Denial-of-Service via Malformed HTTP Headershttps://feed.craftedsignal.io/briefs/2026-07-cve-2024-58368-surrealdb-dos/Sat, 18 Jul 2026 14:21:36 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-cve-2024-58368-surrealdb-dos/Unauthenticated attackers can exploit CVE-2024-58368 in SurrealDB versions prior to 1.1.0 by sending crafted HTTP REST API requests with malformed ID, DB, or NS headers, leading to an uncaught exception and server crash, resulting in denial of service.SurrealDB versions before 1.1.0 are vulnerable to a denial-of-service (DoS) attack identified as CVE-2024-58368, with a CVSS v3.1 base score of 7.5. Unauthenticated attackers can exploit this vulnerability by sending specially crafted HTTP REST API requests. The core issue lies in the improper parsing of the ID, DB, and NS headers when these headers contain specific special characters. This malformation triggers an uncaught exception within the SurrealDB server process, causing it to crash unexpectedly. This leads to the unavailability of the database service, impacting any applications or users relying on it. Organizations running affected SurrealDB instances should prioritize patching to mitigate this availability risk.

Attack Chain

  1. An unauthenticated attacker identifies a vulnerable SurrealDB instance (version prior to 1.1.0) exposed via its HTTP REST API.
  2. The attacker crafts an HTTP POST or PUT request targeting any SurrealDB REST API endpoint (e.g., /sql or /key).
  3. The crafted request includes one or more of the ID, DB, or NS HTTP headers with values containing specially chosen malformed or "special" characters.
  4. The vulnerable SurrealDB server receives the malicious HTTP request.
  5. During the processing and parsing of the HTTP headers, the server encounters the malformed characters in the ID, DB, or NS fields.
  6. The improper parsing logic within SurrealDB fails to handle these characters gracefully, leading to an uncaught exception.
  7. This uncaught exception causes the SurrealDB server process to terminate unexpectedly, resulting in a crash.
  8. The SurrealDB service becomes unavailable, effectively causing a denial-of-service condition for all legitimate users and applications.

Impact

The successful exploitation of CVE-2024-58368 leads directly to a denial-of-service (DoS) condition for the affected SurrealDB instance. This means that the database server will crash and become unresponsive, rendering any applications or services dependent on it inoperable. While no data integrity or confidentiality issues are reported with this specific vulnerability, the sustained unavailability of a critical database service can lead to significant operational disruptions, financial losses, and reputational damage. The impact affects all users and processes attempting to interact with the compromised SurrealDB instance.

Recommendation

  • Patch SurrealDB instances to version 1.1.0 or newer immediately to mitigate CVE-2024-58368.
  • Implement robust monitoring of web server access logs and SurrealDB application logs for signs of unexpected server crashes or restarts.
  • Configure web application firewalls (WAFs) or API gateways to inspect incoming HTTP requests for anomalous character patterns or malformed values within custom HTTP headers like ID, DB, and NS targeting SurrealDB.
]]>lowadvisorydenial-of-serviceweb-vulnerabilitydatabasehttp-apicve