SurrealDB Uncaught Exception Handling Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in SurrealDB versions prior to 2.0.4. The issue arises from uncaught exceptions in the parser's error handling when processing empty strings. Authorized clients can exploit this by sending malformed queries that convert empty strings into record, duration, or datetime types. This conversion failure triggers a panic in the error rendering process, causing the server to crash.

Impact

Exploitation of this vulnerability leads to a server crash, causing a denial-of-service condition.

Remediation

Users can update to SurrealDB version 2.0.4 or later to address this vulnerability. Those unable to update should consider restricting untrusted clients from executing arbitrary SurrealQL queries and ensure the SurrealDB process can automatically restart after a crash.