CVE-2024-58357

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 2.1.0

Description An uncaught exception exists in the rand::time() function. The issue occurs when unwrap is called on a None result from timestamp opt, leading to a server panic. Authorized clients can repeatedly invoke the rand::time() function to trigger this state and cause a denial of service.

Recommendations Update SurrealDB to version 2.1.0 or later. As a temporary workaround, restrict the use of the rand::time() function to minimize the risk of server panics.