SurrealDB versions prior to 2.0.4 expose an uncaught exception when the parser handles empty string inputs in queries, triggering a panic that crashes the server. The effect is a denial of service, disrupting service availability for all users. This weakness maps to CWE-248, an unhandled exception vulnerability.

SurrealDB, versions before 2.0.4. All instances of the database running any of the pre‑2.0.4 releases are susceptible; the remediation is to apply the 2.0.4 update or later.

The CVSS score of 7.1 indicates moderate to high severity. With an EPSS of less than 1%, the likelihood of exploitation is currently low, and the vulnerability is not listed in the CISA KEV catalog. The attack requires an authorized client to send malformed queries that convert empty strings to record, duration, or datetime types. Attackers with such credentials could trigger server crashes, but the impact is confined to service availability rather than data compromise.