CVE-2025-61018

virtuoso-opensource: Openlink Virtuoso-opensource: Denial of Service via crafted SQL statements in sqlo_place_dt_set

Published Jun 23, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

An issue in the sqlo_place_dt_set component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

Analysis

Technical impact

An issue in the sqlo_place_dt_set component of OpenLink Virtuoso Open-Source version 7.2.11 allows attackers to craft specific SQL statements that trigger a denial of service. The flaw causes the database to exhaust resources or terminate unexpectedly, disrupting service availability, and is identified as a SQL injection style vulnerability (CWE-89) focused on availability rather than data exfiltration.

Affected Systems

The vulnerability affects OpenLink Virtuoso-OpenSource version 7.2.11, specifically the sqlo_place_dt_set component. No other affected product versions are indicated in the available data.

Risk and Exploitability

The CVSS score of 7.5 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet. The likely attack vector is remote, where an attacker sends crafted SQL statements to the exposed database interface, causing resource exhaustion or a crash if the database is reachable from untrusted networks.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

affected

Version	Status	Constraints
`n/a`	affected	—

No data.

Vendor Product Versions

Openlink

Virtuoso-opensource

Version	Status	Scheme	Platform
`7.2.11`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Restrict database access to trusted networks or hosts using firewalls and network segmentation.
Implement strict input validation and sanitization rules for SQL queries in the sqlo_place_dt_set component.
Apply application‑level rate limiting or anomaly detection to identify and block excessive or anomalous query activity.
Monitor database logs for repeated patterns of crafted queries indicative of exploitation attempts.

Generated by OpenCVE AI on June 24, 2026 at 10:31 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.681% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://access.redhat.com/security/cve/CVE-2025-61018
https://bugzilla.redhat.com/show_bug.cgi?id=2491820
https://github.com/openlink/virtuoso-opensource/issues/1224
https://nvd.nist.gov/vuln/detail/CVE-2025-61018
https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61018.json
https://www.cve.org/CVERecord?id=CVE-2025-61018

History

Jun 25, 2026 12:15 AM Title updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title	Denial of Service via Crafted SQL Statements in Virtuoso Open-Source Database	virtuoso-opensource: Openlink Virtuoso-opensource: Denial of Service via crafted SQL statements in sqlo_place_dt_set
References		https://nvd.nist.gov/vuln/detail/CVE-2025-61018 https://www.cve.org/CVERecord?id=CVE-2025-61018
Metrics	threat_severity `None`	threat_severity `Important`

Jun 24, 2026 4:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Openlink Openlink virtuoso-opensource
Vendors & Products		Openlink Openlink virtuoso-opensource

Jun 24, 2026 11:00 AM Title updated View changes

Type	Values Removed	Values Added
Title		Denial of Service via Crafted SQL Statements in Virtuoso Open-Source Database

Jun 24, 2026 6:45 AM Title updated View changes

Type	Values Removed	Values Added
Title	Denial of Service via Crafted SQL Statements in OpenLink Virtuoso OpenSource

Jun 24, 2026 2:15 AM Title updated View changes

Type	Values Removed	Values Added
Title		Denial of Service via Crafted SQL Statements in OpenLink Virtuoso OpenSource

Jun 23, 2026 10:45 PM Title updated View changes

Type	Values Removed	Values Added
Title	Denial of Service via Crafted SQL Statements in Virtuoso OpenSource sqlo_place_dt_set

Jun 23, 2026 7:30 PM Title updated View changes

Type	Values Removed	Values Added
Title		Denial of Service via Crafted SQL Statements in Virtuoso OpenSource sqlo_place_dt_set

Jun 23, 2026 5:30 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-89
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 23, 2026 4:45 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description		An issue in the sqlo_place_dt_set component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
References		https://github.com/openlink/virtuoso-opensource/issues/1224