What is the CVSS score of CVE-2025-61025?

CVE-2025-61025 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of Virtuoso OpenSource are affected by CVE-2025-61025?

OpenLink Virtuoso OpenSource v7.2.11 contains a remotely exploitable denial of service vulnerability that allows attackers to crash the database server via malformed SQL statements, causing service…

How to fix or mitigate CVE-2025-61025?

Within 24 hours: Inventory all systems running OpenLink Virtuoso OpenSource v7.2.11 and restrict network access to trusted hosts only via firewall rules. Within 7 days: Implement SQL input validation, enable query logging and anomaly detection, and review vendor advisories for patch availability. Within 30 days: Plan migration to a patched version once available or to an alternative database platform; document this timeline with business stakeholders.

Virtuoso OpenSource CVE-2025-61025

EUVD-2025-210319 HIGH

SQL Injection (CWE-89)

2026-06-23 mitre

GHSA-pcq2-xgpf-f8cv

Denial Of Service SQLi Red Hat N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable SQL/SPARQL endpoint, no auth or interaction implied by description; impact limited to process crash, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 23, 2026 - 19:00 vuln.today

CVSS changed

Jun 23, 2026 - 18:22 NVD

7.5 (HIGH)

CVE Published

Jun 23, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in the sslr_qst_get component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

AnalysisAI

Denial of service in OpenLink Virtuoso OpenSource v7.2.11 allows remote attackers to crash the database server by submitting crafted SQL statements that trigger a fault in the sslr_qst_get component. The flaw is classified under CWE-89 (SQL injection class) but the documented impact is availability-only with no confidentiality or integrity loss per the CVSS vector. No public exploit identified at time of analysis, and the issue is tracked only via an upstream GitHub issue (#1229) rather than a tagged fixed release.

Technical ContextAI

Virtuoso OpenSource is a hybrid relational/RDF/graph database server developed by OpenLink Software, commonly used as a SPARQL endpoint backing semantic web and Linked Data deployments (e.g., DBpedia). The vulnerable routine sslr_qst_get is part of Virtuoso's SQL/SPARQL query state handling layer, which manages SQL-level result/state objects during statement execution. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) is the parent class, but the manifestation here is not data exfiltration - instead, malformed SQL elements reach a code path in sslr_qst_get that fails unsafely, terminating the server process or thread and producing a denial-of-service condition.

RemediationAI

No vendor-released patch identified at time of analysis - the only public tracking artifact is upstream GitHub issue https://github.com/openlink/virtuoso-opensource/issues/1229, with no tagged release advertised as fixing sslr_qst_get. Monitor the openlink/virtuoso-opensource repository for a commit or 7.2.12+ release referencing this issue and upgrade once published. Compensating controls: restrict network access to the Virtuoso SQL port (default 1111) and any HTTP/SPARQL listener (default 8890) to trusted clients via firewall or reverse proxy; enforce authentication on SPARQL endpoints by disabling the default anonymous SPARQL user's ability to issue arbitrary SQL (revoke SPARQL_UPDATE and similar roles), accepting reduced functionality for public Linked Data consumers; deploy a SQL/SPARQL-aware proxy or WAF to drop malformed statements, noting this is brittle without a known trigger payload; run virtuoso-t under a process supervisor (systemd Restart=on-failure) so a DoS crash self-recovers, accepting brief outages and possible repeated triggering.