Description
SurrealDB versions before 2.1.0 contain an uncaught exception vulnerability in the rand::time() function that panics when unwrap is called on a None result from timestamp_opt. Authorized clients can repeatedly invoke rand::time() to reliably trigger server panics and cause denial of service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| surrealdb | surrealdb | < 2.1.0 | 2.1.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | surrealdb | < 2.1.0 | 2.1.0 | GHSA-h4f5-h82v-5w4r |
| crates.io | surrealdb-core | < 2.1.0 | 2.1.0 | GHSA-h4f5-h82v-5w4r |
References
- GitHub Security Advisory (GHSA-h4f5-h82v-5w4r) vendor-advisory
- VulnCheck Advisory: SurrealDB before 2.1.0 Denial of Service via rand::time() third-party-advisory