What is the CVSS score of CVE-2025-61018?

CVE-2025-61018 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of OpenLink Virtuoso are affected by CVE-2025-61018?

OpenLink Virtuoso Open Source Edition v7.2.11 contains a denial-of-service vulnerability enabling remote attackers to crash or hang the database server through crafted SQL queries, directly…

How to fix or mitigate CVE-2025-61018?

Within 24 hours: inventory systems running OpenLink Virtuoso v7.2.11 and assess business criticality; implement database query logging and monitoring for abnormal derived-table SQL patterns. Within 7 days: deploy network segmentation to restrict database access, enforce connection rate limiting, and establish alerting for unexpected server crashes or hung connections. Within 30 days: develop and execute an upgrade or migration plan to move beyond v7.2.11 to a patched version or alternative database platform compatible with your infrastructure.

OpenLink Virtuoso CVE-2025-61018

EUVD-2025-210313 HIGH

SQL Injection (CWE-89)

2026-06-23 mitre

GHSA-h78h-5fwj-q664

Denial Of Service SQLi N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Submitting arbitrary SQL normally needs an authenticated database session, so PR:L rather than NVD's PR:N; impact is an availability-only crash, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 21:06 vuln.today

CVE Published

Jun 23, 2026 - 00:00 cve.org

HIGH 7.5

CVE Published

Jun 23, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in the sqlo_place_dt_set component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

AnalysisAI

Denial of service in OpenLink Virtuoso Open Source Edition v7.2.11 lets remote attackers crash or hang the database server by submitting crafted SQL statements that mishandle derived-table set placement in the sqlo_place_dt_set query-optimizer routine. The flaw carries no confidentiality or integrity impact - only availability (CVSS 7.5, A:H) - and is tracked under CWE-89 although the observed outcome is a crash rather than data exfiltration. No public exploit identified at time of analysis; EPSS is low (0.35%, 27th percentile) and CISA SSVC records exploitation status as none.

Technical ContextAI

Virtuoso is OpenLink's hybrid relational/RDF (SPARQL) database and application server, widely used to back Linked Data and semantic-web endpoints. The defect lives in sqlo_place_dt_set, part of Virtuoso's SQL query optimizer that decides how derived tables (sub-selects/inline views) are placed within the join and execution plan. A malformed or unusually structured SQL statement drives this routine into a fault (for example an invalid dereference or unbounded processing), terminating or hanging the server process. NVD classifies the root cause as CWE-89 (SQL Injection), but the CPE record is a placeholder (cpe:2.3:a:n/a:n/a:*) providing no vendor or product enumeration, so exact affected packaging must be derived from the vendor issue tracker rather than from structured CPE data.

RemediationAI

No vendor-released patched version is identified at time of analysis; the fix is being tracked in upstream GitHub issue #1224 (https://github.com/openlink/virtuoso-opensource/issues/1224), so upgrade to a fixed 7.2.x build as soon as OpenLink tags one and monitor the Red Hat VEX (https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61018.json) for downstream package status. As compensating controls until a patch ships: restrict network reachability of the Virtuoso SQL/ISQL and SPARQL endpoints (default ports 1111 and 8890) to trusted hosts via firewall or ACL so arbitrary SQL cannot be submitted anonymously; disable or authenticate any public SPARQL endpoint (set the anonymous/SPARQL account to read-only or remove its update/query rights), with the trade-off that legitimate open Linked-Data queries break; and enforce least-privilege database accounts plus connection rate-limiting and automatic process restart/supervision so a crash is contained and self-heals. Each control reduces exposure but does not remove the underlying optimizer fault.