CVE-2025-61024 OpenLink CVE debrief

Who should care

Defenders of openlink virtuoso-opensource v7.2.11 installations should be aware of this HIGH severity Denial of Service (DoS) vulnerability. Attackers can exploit this issue via crafted SQL statements, potentially disrupting service. The vulnerability's CVSS score of 7.5 indicates a significant risk.

Technical summary

The sqlo_try_in_loop component of openlink virtuoso-opensource v7.2.11 is vulnerable to a Denial of Service (DoS) attack. This is achieved through crafted SQL statements. The vulnerability's CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating a Network attack vector with Low attack complexity and No privileges required. The vulnerability is classified under CWE-89.

Defensive priority

Defenders should prioritize patching or mitigating this HIGH severity vulnerability. The vulnerability's impact can be significant, with potential for service disruption.

Recommended defensive actions

• Review and apply patches or updates for openlink virtuoso-opensource v7.2.11.
• Implement compensating controls, such as monitoring and filtering of SQL statements.
• Perform inventory checks to identify affected installations.
• Consider vendor remediation workflow for openlink virtuoso-opensource v7.2.11.

Evidence notes

The CVE record and NVD detail provide official information about this vulnerability. A source reference on GitHub discusses the issue. However, the corpus does not provide extensive additional metadata or detailed impact analysis.

Official resources