---
id: CVE-2024-58370
title: >-
  SurrealDB versions before 1.1.0 fail to enforce recursion depth limits when
  parsing nested SurrealQL statements including IF, RELATE, and attribute access
  idioms
summary: >-
  SurrealDB versions before 1.1.0 fail to enforce recursion depth limits when
  parsing nested SurrealQL statements including IF, RELATE, and attribute access
  idioms. Authorized attackers can submit queries with excessive nesting depth
  to ca…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-674
published: '2026-07-18'
updated: '2026-07-18'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-58370'
references:
  - url: >-
      https://github.com/surrealdb/surrealdb/security/advisories/GHSA-6r8p-hpg7-825g
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/surrealdb-before-uncontrolled-recursion-denial-of-service
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-07-19T05:29:21.074Z'
epss: 0.00487
epssPercentile: 0.39264
---

## Overview

SurrealDB versions before 1.1.0 fail to enforce recursion depth limits when parsing nested SurrealQL statements including IF, RELATE, and attribute access idioms. Authorized attackers can submit queries with excessive nesting depth to cause stack overflow and crash the server.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.