What is the CVSS score of CVE-2025-61019?

CVE-2025-61019 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of OpenLink Virtuoso are affected by CVE-2025-61019?

OpenLink Virtuoso Open-Source Edition 7.2.11 contains a high-severity database availability vulnerability that enables remote attackers to trigger service outages via malicious SQL queries, creating…

How to fix or mitigate CVE-2025-61019?

Within 24 hours: Inventory all systems running OpenLink Virtuoso 7.2.11 and document exposure scope (direct network access vs. application-mediated). Within 7 days: Restrict network access to Virtuoso instances via firewall rules (whitelist trusted application servers and administrators only); enable SQL query logging and rate-limiting; implement input validation at application layers connecting to Virtuoso. Within 30 days: Monitor vendor GitHub issue #1222 and OpenLink security advisories for patch release; evaluate and test upgrade path to Virtuoso 8.x or alternative database platforms; execute upgrade if patch or newer stable release becomes available.

OpenLink Virtuoso CVE-2025-61019

EUVD-2025-210314 HIGH

SQL Injection (CWE-89)

2026-06-23 mitre

GHSA-ph87-jqrm-qmr3

Denial Of Service SQLi Red Hat N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Submitting arbitrary SQL normally requires query-capable credentials, so PR:L rather than PR:N; network-reachable, low-complexity, availability-only crash with no confidentiality or integrity impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 20:23 vuln.today

CVSS changed

Jun 25, 2026 - 20:22 NVD

7.5 (HIGH)

CVE Published

Jun 23, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in the sqlo_key_part_best component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

AnalysisAI

Denial of service in OpenLink Virtuoso Open-Source Edition 7.2.11 lets attackers crash the database server by submitting crafted SQL statements that mishandle the sqlo_key_part_best query-optimizer routine. The flaw carries no confidentiality or integrity impact (availability-only, CVSS 7.5) and there is no public exploit identified at time of analysis; EPSS is low at 0.15% (4th percentile), and it is not listed in CISA KEV. The only public reference is the upstream GitHub issue (#1222) tracking the crash.

Technical ContextAI

Virtuoso is a multi-model database and RDF triplestore (the engine behind large linked-data deployments such as DBpedia) that exposes SQL and, in many installations, SPARQL-over-SQL endpoints. The affected component, sqlo_key_part_best, is part of the SQL cost-based query optimizer responsible for choosing the best index key part during query planning. Although the record is tagged CWE-89 (SQL Injection), the observed and scored effect is purely a crash/Denial of Service (A:H, with C:N/I:N) rather than data exfiltration or injection of unauthorized queries - the CWE class here points to malformed/crafted SQL reaching a code path the optimizer fails to handle safely, leading to abnormal termination. The CPE entry is a placeholder (cpe:2.3:a:n/a:n/a:*) and provides no usable product/version match, so version scoping relies on the textual reference to v7.2.11.

RemediationAI

No vendor-released patch version is identified at time of analysis; the only upstream artifact is GitHub issue https://github.com/openlink/virtuoso-opensource/issues/1222, so monitor that issue and the openlink/virtuoso-opensource releases for a fixed tag and upgrade as soon as one is published past 7.2.11. As compensating controls until a fix exists: require authentication for all SQL access and disable or firewall any anonymous public SPARQL/SQL endpoint (Virtuoso's /sparql and SQL listener) so untrusted clients cannot submit arbitrary queries - trade-off is loss of public linked-data query access; restrict the database listener to trusted networks via host firewall or bind-address; and apply rate limiting / connection quotas and process supervision (auto-restart, e.g. systemd Restart=on-failure) to limit and recover from crash-based DoS, accepting that this mitigates impact rather than preventing the crash.