Uncaught Exception Affecting surrealdb-core package, versions <2.0.5>=2.1.0 <2.1.5>=2.2.0 <2.2.2
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RUST-SURREALDBCORE-10080082
- published9 May 2025
- disclosed10 Apr 2025
- creditcastilho101
Introduced: 10 Apr 2025
CVE NOT AVAILABLE CWE-248 (opens in a new tab)How to fix?
Upgrade surrealdb-core to version 2.0.5, 2.1.5, 2.2.2 or higher.
Overview
Affected versions of this package are vulnerable to Uncaught Exception via the net module. An attacker can crash the database by crafting a HTTP query that returns a null byte.
Note:
This is only exploitable if the attacker is authenticated and can send queries to the /sql endpoint.
Workaround
This vulnerability can be mitigated by limiting the ability of untrusted clients to run arbitrary queries and ensuring input sanitisation at the application layer to prevent injection attacks. Additionally, administrators may want to configure the SurrealDB process for automatic restart after a crash.