CVE-2025-61020

virtuoso-opensource: openlink virtuoso-opensource: Denial of Service via crafted SQL statements

Published Jun 23, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

An issue in the sqlo_strip_in_join component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

Analysis

Technical impact

The vulnerability resides in the sqlo_strip_in_join component of OpenLink Virtuoso Open Source version 7.2.11. When an attacker submits specially crafted SQL statements, the component fails to properly validate or sanitize the input, causing the database engine to enter an abnormal state or consume excessive resources. This results in a loss of availability for the database service and any applications that depend on it.

Affected Systems

OpenLink Virtuoso Open Source version 7.2.11 is the only version explicitly documented as affected. No other products, vendors, or versions have been identified in the current data.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity, though the EPSS score is not available, so the exact likelihood of exploitation is unknown. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation has been recorded. The attack vector is inferred to be remote: an attacker would need network access to the database’s interface to send malformed SQL queries.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

affected

Version	Status	Constraints
`n/a`	affected	—

No data.

Vendor Product Versions

Openlink

Virtuoso-opensource

Version	Status	Scheme	Platform
`7.2.11`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to a version of OpenLink Virtuoso Open Source that includes the fix for the sqlo_strip_in_join component.
If an upgrade cannot be performed immediately, enforce stricter query timeouts, restrict the complexity or length of incoming SQL commands, and limit which clients are allowed to execute queries against the database.
Network perimeter controls such as firewall rules, VPN, or subnet segmentation should be applied to restrict external access to the database server and reduce the attack surface.

Generated by OpenCVE AI on June 24, 2026 at 09:29 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.578% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://access.redhat.com/security/cve/CVE-2025-61020
https://bugzilla.redhat.com/show_bug.cgi?id=2491816
https://github.com/openlink/virtuoso-opensource/issues/1225
https://nvd.nist.gov/vuln/detail/CVE-2025-61020
https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61020.json
https://www.cve.org/CVERecord?id=CVE-2025-61020

History

Jun 25, 2026 12:15 AM Title updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title	Denial of Service via Crafted SQL in OpenLink Virtuoso's sqlo_strip_in_join	virtuoso-opensource: openlink virtuoso-opensource: Denial of Service via crafted SQL statements
References		https://nvd.nist.gov/vuln/detail/CVE-2025-61020 https://www.cve.org/CVERecord?id=CVE-2025-61020
Metrics	threat_severity `None`	threat_severity `Important`

Jun 24, 2026 4:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Openlink Openlink virtuoso-opensource
Vendors & Products		Openlink Openlink virtuoso-opensource

Jun 24, 2026 7:30 AM Title updated View changes

Type	Values Removed	Values Added
Title		Denial of Service via Crafted SQL in OpenLink Virtuoso's sqlo_strip_in_join

Jun 24, 2026 3:30 AM Title updated View changes

Type	Values Removed	Values Added
Title	Denial of Service via Crafted SQL in Virtuoso sqlo_strip_in_join

Jun 24, 2026 12:30 AM Title updated View changes

Type	Values Removed	Values Added
Title		Denial of Service via Crafted SQL in Virtuoso sqlo_strip_in_join

Jun 23, 2026 10:45 PM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title	Denial of Service via Crafted SQL Statements in Virtuoso sqlo_strip_in_join Component
Weaknesses	CWE-207 CWE-770

Jun 23, 2026 7:30 PM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title		Denial of Service via Crafted SQL Statements in Virtuoso sqlo_strip_in_join Component
Weaknesses		CWE-207 CWE-770

Jun 23, 2026 6:30 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-89
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 23, 2026 4:45 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description		An issue in the sqlo_strip_in_join component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
References		https://github.com/openlink/virtuoso-opensource/issues/1225