SurrealDB versions earlier than 2.1.0 contain an uncaught exception in the rand::time() function. When the function attempts to unwrap a None result from timestamp_opt, a panic is triggered. This flaw is classified as CWE‑248, an Unchecked Return Value issue. The result is a server crash that interrupts service availability for all clients connected to the database.

The vulnerability affects all SurrealDB deployments using a version prior to 2.1.0. The affected product, identified by the CNA as surrealdb:surrealdb, does not specify a particular minor release; any build before the 2.1.0 milestone is potentially impacted.

The CVSS score of 7.1 indicates a high severity impact. The EPSS score is below 1 %, suggesting a low likelihood that the flaw will be actively exploited as of the last assessment. The flaw is not listed in the CISA KEV catalog. Exploitation requires an authorized client to repeatedly call rand::time(); the description implies that authentication is needed for the client to invoke the method, meaning the attack vector is internal or trusted. Once the function is invoked, the server panics without recovery, leading to denial of service for all users.