What is the CVSS score of CVE-2025-61023?

CVE-2025-61023 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of OpenLink Virtuoso are affected by CVE-2025-61023?

OpenLink Virtuoso open-source edition (v7.2.11) contains a denial-of-service vulnerability that allows attackers to crash the database server using crafted SQL statements, disrupting service…

How to fix or mitigate CVE-2025-61023?

Within 24 hours: Inventory all systems running OpenLink Virtuoso open-source v7.2.11 and assess criticality; enable SQL query logging. Within 7 days: Deploy SQL input validation and parameterized query enforcement; establish monitoring for malformed or abnormal SQL patterns. Within 30 days: Plan upgrade to vendor-released patched version when available, or evaluate migration to alternative database platform; establish formal patch application timeline from OpenLink.

OpenLink Virtuoso CVE-2025-61023

EUVD-2025-210318 HIGH

SQL Injection (CWE-89)

2026-06-23 mitre

GHSA-fgcp-r4fm-q7gx

Denial Of Service SQLi N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-reachable, low-complexity DoS, but submitting SQL typically needs a database session so PR:L; availability-only impact (A:H), no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 21:31 vuln.today

CVSS changed

Jun 25, 2026 - 19:22 NVD

7.5 (HIGH)

CVE Published

Jun 23, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in the st_compare component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

AnalysisAI

Denial of service in OpenLink Virtuoso (open-source edition) v7.2.11 allows attackers to crash the database server by submitting crafted SQL statements that mishandle the internal st_compare comparison routine. The flaw affects availability only (CVSS A:H, no confidentiality or integrity impact) and carries a 7.5 base score; EPSS is low (0.15%, 5th percentile) with no public exploit identified at time of analysis and no CISA KEV listing. Despite the CWE-89 (SQL Injection) classification, the reported effect is a service crash rather than data manipulation or extraction.

Technical ContextAI

Virtuoso is OpenLink's multi-model database server combining a relational SQL engine with an RDF triplestore and SPARQL/SPARQL-over-SQL endpoints, commonly used as a backend for linked-data and semantic-web deployments. The defect lives in the st_compare component - an internal value/sort comparison routine invoked during SQL query processing - where a crafted statement drives the comparison logic into an error state (e.g., type mishandling, null/structure dereference, or unbounded resource use) that terminates the server process. The assigned CWE-89 (Improper Neutralization of Special Elements in an SQL Command) flags this as an SQL-injection class issue, but the documented consequence is denial of service via the SQL parser/executor rather than classic injection-driven data disclosure; this CWE-vs-impact mismatch should be treated as a tagging artifact pending vendor confirmation. The CPE provided (cpe:2.3:a:n/a:n/a:*) is a placeholder and does not concretely identify the product, so version scoping relies on the description's explicit mention of v7.2.11.

RemediationAI

No vendor-released patch identified at time of analysis; the only upstream artifact is the bug report at https://github.com/openlink/virtuoso-opensource/issues/1230, so monitor that issue and the OpenLink virtuoso-opensource releases for a fixed tag and upgrade as soon as one is published. As compensating controls until a fix ships, restrict who can submit SQL to the server: enforce database authentication and least-privilege accounts, and disable or firewall any anonymous SQL-capable access paths (e.g., block external access to the SQL listener port and restrict the HTTP/SPARQL endpoints to trusted clients), accepting that locking down SPARQL/HTTP access may break public linked-data consumers. Place Virtuoso behind a reverse proxy or query gateway that can rate-limit and reject malformed statements, and ensure the process runs under a supervisor (systemd/restart policy) so a crash auto-recovers - noting this mitigates downtime but not the repeated-crash DoS itself. Validate the NVD/EUVD entries (https://nvd.nist.gov/vuln/detail/CVE-2025-61023) for an updated fixed version before relying on these workarounds.