Technical impact
An issue exists in the sqlo_natural_join_cond component of OpenLink Virtuoso OpenSource v7.2.11. The flaw allows an attacker to cause a denial of service by sending specially crafted SQL statements to the database. The result is a loss of availability for the database service, which can impact any applications that rely on it. This weakness is identified as uncontrolled resource consumption, corresponding to a denial of service scenario.
Affected Systems
OpenLink Virtuoso OpenSource 7.2.11, specifically the sqlo_natural_join_cond component. No other vendors or product variants are listed. Users deploying this version should verify whether this component is in use in their environment.
Risk and Exploitability
The CVSS score of 7.5 indicates a high severity denial of service vulnerability. EPSS score of 0.00149 (<1%) indicates a very low but non‑zero exploitation probability. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not been widely reported or exploited. The attack vector is inferred to be the ability to communicate with the database engine and submit malformed SQL, which would require access that is either unauthenticated or weakly authenticated. Because the impact is a service disruption, the risk to affected systems remains significant; an attacker who can reach the database interface can potentially interrupt the availability of critical services. The lack of an available patch or workaround in the official CNA data suggests that mitigation will rely on limiting exposure and monitoring for abnormal query activity.
