EUVD-2025-210320
GHSA-94jw-xcff-qwrc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable and low-complexity, but issuing arbitrary SQL realistically needs a valid session, so PR:L; impact is availability-only (process crash), hence C:N/I:N/A:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
3DescriptionCVE.org
An issue in the t_set_push component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
AnalysisAI
Denial of service in OpenLink Virtuoso Open Source Edition 7.2.11 lets attackers crash the database engine by submitting crafted SQL statements that mishandle the internal t_set_push routine. The flaw carries availability-only impact (CVSS 7.5, A:H) with no confidentiality or integrity loss. EPSS is low (0.15%, 4th percentile), there is no public exploit identified at time of analysis, and it is not listed in CISA KEV - so risk is theoretical rather than actively exploited.
Technical ContextAI
Virtuoso is OpenLink's multi-model database and RDF triplestore (notably the engine behind DBpedia and many Linked Open Data endpoints), exposing a SQL/SPARQL query interface. The fault sits in the t_set_push component, an internal set/stack-management helper invoked during SQL statement processing, where a crafted query drives the engine into an unhandled state and aborts the process. MITRE classifies the root cause as CWE-89 (SQL Injection), but the realized impact is denial of service rather than data manipulation or query injection - the CWE mapping describes how the malicious SQL is delivered more than the actual memory/state failure it triggers, so the CWE should be treated as approximate.
RemediationAI
No vendor-released patch identified at time of analysis - the only reference is an open GitHub issue (openlink/virtuoso-opensource#1232), not a tagged release, PR, or commit, so monitor that issue and the project releases for a fixed build and upgrade to it once published. As compensating controls until a fix ships: restrict who can submit ad-hoc SQL by enforcing authentication on the Virtuoso SQL/ODBC/JDBC and HTTP SPARQL endpoints and revoking interactive SQL privileges from untrusted or application-only accounts (trade-off: may break tools that rely on direct SQL access); place the database behind network ACLs or a firewall so the listener (default port 1111, and the HTTP endpoint) is reachable only from trusted application tiers (trade-off: complicates legitimate remote administration); and front public SPARQL/SQL with a query gateway or proxy that constrains or validates statement shapes (trade-off: added latency and possible false rejections). Pair these with process supervision/auto-restart so a crash causes minimal downtime. Confirm details against the upstream issue at https://github.com/openlink/virtuoso-opensource/issues/1232.
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Unauthenticated remote OS command injection in MeiG Smart FORGE_SLT711 cellular gateway firmware MDM9607.LE.1.0-00110-ST
Unauthenticated API access in LalanaChami Pharmacy Management System (commit 5c3d028) allows remote attackers to dump al
In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write o
Giflib 5.2.2 contains a buffer overflow in the EGifGCBToExtension function that fails to validate allocated memory when
Denial of service in GPAC's MP4Box multimedia tool (versions before 26.02.0) arises from a use-after-free in the gf_sei_
Arbitrary kernel memory read/write in Realtek rtl819x Jungle SDK Wi-Fi driver allows local unprivileged attackers to acc
Denial of service in GPAC's MP4Box/libgpac media importer (versions before 26.02.0) lets an attacker crash the tool by s
An issue in the parse_month function (/time/strptime.rs) of relibc commit ab6a2e allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library) at commit 61f42d allows attackers to crash a process by ge
An issue in the pthread_rwlockattr_setpshared() function of relibc commit 61f42d allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library implementation, commit 61f42d) lets attackers crash a proce
Same weakness CWE-89 – SQL Injection
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today