---
id: CVE-2024-58368
title: >-
  SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS
  headers in HTTP REST API requests containing special characters
summary: >-
  SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS
  headers in HTTP REST API requests containing special characters.
  Unauthenticated attackers can send crafted HTTP requests with malformed header
  values to trigger a…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-248
published: '2026-07-18'
updated: '2026-07-18'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-58368'
references:
  - url: >-
      https://github.com/surrealdb/surrealdb/security/advisories/GHSA-m24x-r6q3-2vp9
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-http-headers
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-07-19T03:27:58.489Z'
epss: 0.00653
epssPercentile: 0.4905
---

## Overview

SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API requests containing special characters. Unauthenticated attackers can send crafted HTTP requests with malformed header values to trigger an uncaught exception that crashes the server.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.