What is the CVSS score of CVE-2025-61020?

CVE-2025-61020 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of Virtuoso OpenSource are affected by CVE-2025-61020?

OpenLink Virtuoso OpenSource v7.2.11 is vulnerable to remote denial-of-service attacks from the public network, affecting database availability and continuity of dependent applications without…

How to fix or mitigate CVE-2025-61020?

24 hours: Identify all systems running OpenLink Virtuoso v7.2.11 and assess business criticality; immediately restrict database network access to trusted hosts only through firewall rules. 7 days: Implement network segmentation isolating Virtuoso instances; enable query logging and set up alerts for abnormal SQL patterns; begin evaluation of upgrades or alternative database solutions. 30 days: Monitor OpenLink advisory channels for patch release; deploy patched version when available or complete migration to alternative if appropriate; validate network segmentation and monitoring effectiveness.

Virtuoso OpenSource CVE-2025-61020

EUVD-2025-210315 HIGH

SQL Injection (CWE-89)

2026-06-23 mitre

GHSA-4c35-xvpv-9965

Denial Of Service SQLi N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Submitting arbitrary SQL to Virtuoso normally requires a database account, so PR:L rather than PR:N; only availability is affected.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 23, 2026 - 19:00 vuln.today

CVSS changed

Jun 23, 2026 - 18:22 NVD

7.5 (HIGH)

CVE Published

Jun 23, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in the sqlo_strip_in_join component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

AnalysisAI

Denial of service in OpenLink Virtuoso OpenSource v7.2.11 allows remote unauthenticated attackers to crash the database server by submitting crafted SQL statements that trigger a fault in the sqlo_strip_in_join query-optimization component. The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N) reflects network-reachable, no-auth exploitation with high availability impact and no confidentiality or integrity loss. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Virtuoso OpenSource is a multi-model hybrid database server from OpenLink Software that combines relational SQL with RDF/SPARQL, XML, and web-services functionality, frequently deployed as the back-end for linked-data endpoints such as DBpedia. The defect lives in sqlo_strip_in_join, an internal SQL optimizer routine that rewrites IN-clauses inside JOINs to more efficient predicate forms. The CWE-89 (SQL Injection) classification is somewhat loose for this finding; the root cause is more accurately an unsafe handling of attacker-controlled SQL constructs during query planning that crashes the server process, rather than classic data exfiltration via injected SQL. The single reference is an upstream GitHub issue (openlink/virtuoso-opensource#1225) tracking the crash.

RemediationAI

No vendor-released patch identified at time of analysis - the only public artifact is upstream issue openlink/virtuoso-opensource#1225, and no tagged release supersedes 7.2.11 in the supplied data, so administrators should monitor that issue and the openlink/virtuoso-opensource releases page for a fixed build and upgrade as soon as it appears. As compensating controls, restrict the Virtuoso SQL listener (default TCP 1111) to trusted management networks via host firewall or perimeter ACLs (trade-off: breaks remote SQL clients but typically does not affect SPARQL/HTTP on 8890), require authentication on all Virtuoso accounts and disable or strongly password-protect the dba/dav default users so that anonymous attackers cannot submit arbitrary SQL, and consider placing a query-aware proxy or rate limiter in front of the SQL endpoint to throttle suspicious traffic until a patched build is installed. After deployment of any fix, validate by reproducing the crash with the PoC from issue #1225 in a staging environment.