CVE-2024-58358 SurrealDB before 2.1.0 Denial of Service via Nonexistent Role

What is CVE-2024-58358?

CVE-2024-58358 is a medium-severity denial of service vulnerability in Surrealdb Surrealdb, published on 18 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

SurrealDB versions before 2.1.0 contain a denial of service vulnerability in role conversion that allows privileged owner users to define users with nonexistent roles. Attackers can trigger an uncaught panic by signing in with a user assigned an invalid role, crashing the server.

Weakness: CWE-248

Which versions are affected by CVE-2024-58358?

4 open source packages ship an affected version, including surrealdb and surrealdb-core. It affects 1 product.

Products include Surrealdb Surrealdb.

How do I fix CVE-2024-58358?

Upgrade surrealdb to 2.1.0 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2024-58358 being exploited?

There is no known exploitation of CVE-2024-58358 in the wild and no public exploit code.

Other vulnerabilities in Surrealdb Surrealdb

• CVE-2025-71392 SurrealDB before 2.2.2 SurrealQL Injection via export Critical 9.4
• CVE-2026-63756 SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Condition Critical 9.2
• CVE-2026-63747 SurrealDB before 3.1.0 Denial of Service via malformed RPC use High 8.7
• CVE-2026-63757 SurrealDB before 3.1.0 Session Hijacking via /rpc sessions High 8.7
• CVE-2026-63760 SurrealDB before 3.1.0 Denial of Service via JSON Parser High 8.7

All Surrealdb Surrealdb vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-jc55-246c-r88f.