CVE-2025-61021
Deferred Deferred - Pending Action

Denial of Service in Virtuoso Open-Source Database

Publication date: 2026-06-23

Last updated on: 2026-06-25

Assigner: MITRE

Description
An issue in the sqlo_natural_join_cond component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-06-23
Last Modified
2026-06-25
Generated
2026-07-14
AI Q&A
2026-06-23
EPSS Evaluated
2026-07-12
NVD
CVE-2025-61021
EUVD
EUVD-2025-210316

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openlink virtuoso-opensource 7.2.11

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Compliance Impact

The provided information does not specify any impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Mitigation Strategies

There are no specific mitigation steps or fixes mentioned in the provided resources for this vulnerability.

Since the issue causes a Denial of Service via crafted SQL statements, immediate steps could include restricting or validating user input to prevent execution of untrusted or complex SQL queries that might trigger the vulnerability.

Monitoring and limiting access to the vulnerable component (sqlo_natural_join_cond) or the affected version (Virtuoso 7.2.11) until a patch or update is available is advisable.

Executive Summary

This vulnerability exists in the sqlo_natural_join_cond component of openlink virtuoso-opensource version 7.2.11. It allows attackers to cause a Denial of Service (DoS) by submitting specially crafted SQL statements that trigger a crash in the software.

The issue was demonstrated using a fuzzer-generated Proof of Concept SQL query involving complex SQL operations such as NATURAL JOIN, GROUP BY, HAVING, and subqueries in UPDATE statements, which leads to a crash in the function sqlo_natural_join_cond.

Impact Analysis

This vulnerability can impact you by causing a Denial of Service (DoS) condition in the openlink virtuoso-opensource software. An attacker can exploit this by sending crafted SQL queries that crash the system, potentially making the database service unavailable to legitimate users.

Detection Guidance

This vulnerability can be detected by attempting to reproduce the crash using crafted SQL queries that exploit the sqlo_natural_join_cond component. Specifically, running SQL statements involving NATURAL JOIN, GROUP BY, HAVING, and subqueries in UPDATE statements similar to the fuzzer-generated Proof of Concept (PoC) can reveal the issue.

One approach is to execute the PoC SQL queries in a controlled environment or directly on the affected Virtuoso 7.2.11 instance to observe if a crash or Denial of Service occurs.

The issue was reproduced using a Docker container, so setting up a similar containerized environment with Virtuoso 7.2.11 and running the PoC queries can help detect the vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-61021. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart