---
id: CVE-2024-58361
title: >-
  SurrealDB versions before 2.0.4 contain an uncaught exception handling
  vulnerability in the parser error rendering code when processing empty strings
summary: >-
  SurrealDB versions before 2.0.4 contain an uncaught exception handling
  vulnerability in the parser error rendering code when processing empty
  strings. Authorized clients can execute malformed queries with empty string
  conversions to reco…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-248
published: '2026-07-18'
updated: '2026-07-18'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-58361'
references:
  - url: >-
      https://github.com/surrealdb/surrealdb/security/advisories/GHSA-qjrv-v6qp-x99x
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-parser-exception
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-07-19T03:27:58.346Z'
epss: 0.0045
epssPercentile: 0.36503
---

## Overview

SurrealDB versions before 2.0.4 contain an uncaught exception handling vulnerability in the parser error rendering code when processing empty strings. Authorized clients can execute malformed queries with empty string conversions to record, duration, or datetime types that cause a panic in error rendering, crashing the server.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.