Answer in brief
CVE-2024-58368 records a High severity (CVSS 7.5) vulnerability in Uncaught Exception processing HTTP Headers in SurrealDB. The current sources do not mark it as known exploited. The current feed maps surrealdb (rust). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps surrealdb (rust). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| surrealdbrust | <1.1.0 | 1.1.0 |
Published upstream
Jan 18, 2024
Evidence: source:ghsa:source_dates:source-dates:recordSource modified
Sep 4, 2026
Evidence: source:ghsa:source_dates:source-dates:recordFirst seen by HOL
Aug 14, 2026
The `ID`, `DB` and `NS` headers accepted by the SurrealDB HTTP REST API would fail to parse when containing some special characters. This would cause a panic which would crash the SurrealDB server, leading to denial of service. This issue only affects the SurrealDB binary; it does not affect the SurrealDB library. ### Impact An unauthenticated client may issue an HTTP request to the SurrealDB HTTP REST API containing one of the affected headers with values containing special characters in order to crash the SurrealDB server. This does not require the SurrealDB server to be running with any specific capabilities other than exposing the affected interface. ### Patches - Version 1.1.0 and later are not affected by this issue. ### Workarounds Concerned users unable to update may want to limit untrusted access to the SurrealDB HTTP REST API unless such access is required by the application. To limit the impact of the denial of service, SurrealDB administrators may also want to ensure that the SurrealDB process is running so that it can be automatically re-started after a crash. ### Resources - #2985 ([diff](https://github.com/surrealdb/surrealdb/pull/2985/files#diff-7ad06ddbb88d77138e5daf40a0dac5443d78947acd69a284a7c2bceb61f9c5f0L83-R119))
Quoted source text, attributed separately from HOL analysis.