The st_compare component of OpenLink Virtuoso OpenSource contains a bug that allows attackers to trigger a denial of service by sending specially crafted SQL statements. The flaw permits the creation of queries that cause the database engine to consume excessive resources or crash, leading to service interruption. This weakness is a typical resource‑consumption vulnerability, classified under CWE-770 and CWE-89 for SQL injection.

The issue affects OpenLink Virtuoso OpenSource version 7.2.11. No other versions are listed as affected. Administrators should verify that this exact version is deployed and assess whether it is still in use.

The KEV status indicates that it is not listed in the CISA KEV catalog, and no CVSS or EPSS score is publicly available, so the precise severity and exploit likelihood remain unknown. The description indicates that an attacker must be able to execute arbitrary SQL against the database, implying that the threat is most relevant to environments where the database is exposed to untrusted input or where authentication mechanisms are weak. If crafted SQL reaches the st_compare component, the resulting denial of service could affect all users of the database instance.