Advisory Database
  • Advisories
  • Dependency Scanning
  1. cargo
  2. ›
  3. surrealdb
  4. ›
  5. GHSA-rq86-9m6r-cm3g

GHSA-rq86-9m6r-cm3g: SurrealDB has uncaught exception in Net module that leads to database crash

April 10, 2025

A vulnerability was found where an attacker can crash the database via crafting a HTTP query that returns a null byte. The problem relies on an uncaught exception in the net module, where the result of the query will be converted to JSON before showing as the HTTP response to the user in the /sql endpoint.

References

  • github.com/advisories/GHSA-rq86-9m6r-cm3g
  • github.com/surrealdb/surrealdb
  • github.com/surrealdb/surrealdb/pull/5647
  • github.com/surrealdb/surrealdb/security/advisories/GHSA-rq86-9m6r-cm3g

Code Behaviors & Features

Detect and mitigate GHSA-rq86-9m6r-cm3g with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 2.0.5, all versions starting from 2.1.0 before 2.1.5, all versions starting from 2.2.0 before 2.2.2

Fixed versions

  • 2.2.2
  • 2.1.5
  • 2.0.5

Solution

Upgrade to versions 2.0.5, 2.1.5, 2.2.2 or above.

Weakness

  • CWE-248: Uncaught Exception

Source file

cargo/surrealdb/GHSA-rq86-9m6r-cm3g.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 12:15:28 +0000.