CVE-2024-58368

EUVD-2024-55684
SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API requests containing special characters. Unauthenticated attackers can send crafted HTTP requests with malformed header values to trigger an uncaught exception that crashes the server.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 48.8%
Affected Products (NVD)
VendorProductVersion
surrealdbsurrealdb
𝑥
< 1.1.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/surrealdb/surrealdb/security/advisories/GHSA-m24x-r6q3-2vp9
https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-http-headers