An issue in the sqlo_key_part_best component of OpenLink Virtuoso OpenSource version 7.2.11 allows attackers to trigger a denial of service by submitting specially crafted SQL statements. It can cause the database engine to become unresponsive or temporarily unavailable, disrupting availability for applications that rely on the database.

The vulnerability is present only in Virtuoso OpenSource version 7.2.11. No other affected versions are identified. The vendor is OpenLink, and the issue exists within the sqlo_key_part_best component.

The CVSS score is not provided, but the impact is a denial of service which can severely affect operations. The EPSS score is unavailable, so the likelihood of exploitation is unclear. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widely known exploitation. Likely attack vectors include any SQL client or front‑end that sends queries to the database; the attacker only needs the ability to submit queries and does not require elevated privileges. Once triggered, the service may crash or hang, allowing an attacker to deny access. The effect is confined to the target database instance unless the vulnerability can be leveraged to affect other components or applications built atop the database.