CVE-2024-58368
High · 7.5CVSS
7.5
EPSS
0.7%
Published
Jul 18, 2026
CISA due date
—
The record
SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API requests containing special characters. Unauthenticated attackers can send crafted HTTP requests with malformed header values to trigger an uncaught exception that crashes the server.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-100347 kin-openapi is a Go project for handling OpenAPI files. CWE-248
- CVE-2026-102599 Socket.IO enables bidirectional and low-latency communication for every platform. CWE-248
- CVE-2026-107382 MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB… CWE-248
- CVE-2026-106122 The RabbitMQ Java client library allows Java and JVM-based applications to connect to and… CWE-248
- CVE-2026-105757 vLLM is an inference and serving engine for large language models. CWE-248
- CVE-2026-105756 vLLM is an inference and serving engine for large language models. CWE-248
- CVE-2026-103387 A weakness has been identified in garycourt uri-js up to 4.4.1. CWE-248
- CVE-2026-102281 Nest is a framework for building scalable Node.js server-side applications. CWE-248