What is the CVSS score of CVE-2025-61021?

CVE-2025-61021 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of N A are affected by CVE-2025-61021?

OpenLink Virtuoso Open Source Edition 7.2.11 contains a high-severity denial-of-service vulnerability affecting database availability through network-based attacks on the query optimizer.

How to fix or mitigate CVE-2025-61021?

Within 24 hours: Identify all systems running Virtuoso 7.2.11, assess criticality to business operations, and enable database activity monitoring and alerting on suspicious query patterns. Within 7 days: Evaluate feasibility of upgrading to alternative database platforms or transitioning to maintained versions with vendor security support. Within 30 days: Complete migration planning or implement network-level access controls restricting database connections to trusted internal sources only.

N A CVE-2025-61021

EUVD-2025-210316 HIGH

SQL Injection (CWE-89)

2026-06-23 mitre

GHSA-7q5w-m9wx-x74m

SQLi Denial Of Service N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 20:24 vuln.today

CVSS changed

Jun 25, 2026 - 20:22 NVD

7.5 (HIGH)

CVE Published

Jun 23, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in the sqlo_natural_join_cond component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

AnalysisAI

Denial of service in OpenLink Virtuoso Open Source Edition 7.2.11 lets attackers crash the database server by submitting crafted SQL statements that trigger a fault in the sqlo_natural_join_cond query-optimizer component. The flaw carries no confidentiality or integrity impact but fully degrades availability (CVSS 7.5, A:H). There is no public exploit identified at time of analysis and EPSS is low (0.15%), indicating limited near-term exploitation likelihood; only a GitHub issue documenting the defect is published.