Advisory Database
  • Advisories
  • Dependency Scanning
  1. cargo
  2. ›
  3. surrealdb
  4. ›
  5. GHSA-qjrv-v6qp-x99x

GHSA-qjrv-v6qp-x99x: SurrealDB has an Uncaught Exception Handling Parsing Errors on Empty Strings

October 8, 2024

The error rendering code from the parser would panic when handling failed parsing of queries where the error occurred when converting an empty string to a SurrealDB value. This would be the case when casting an empty string to a record, duration or datetime, as well as potentially when parsing an empty string to JSON or providing an empty string to the type::field and type::fields functions.

References

  • github.com/advisories/GHSA-qjrv-v6qp-x99x
  • github.com/surrealdb/surrealdb
  • github.com/surrealdb/surrealdb/commit/709d6efe901dbf3e207b4fc2ebc30775595efc16
  • github.com/surrealdb/surrealdb/pull/4923
  • github.com/surrealdb/surrealdb/security/advisories/GHSA-qjrv-v6qp-x99x

Code Behaviors & Features

Detect and mitigate GHSA-qjrv-v6qp-x99x with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions starting from 2.0.0 before 2.0.4

Fixed versions

  • 2.0.4

Solution

Upgrade to version 2.0.4 or above.

Impact 6.5 MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Learn more about CVSS

Weakness

  • CWE-248: Uncaught Exception

Source file

cargo/surrealdb/GHSA-qjrv-v6qp-x99x.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 12:16:05 +0000.