What is the CVSS score of CVE-2025-61028?

CVE-2025-61028 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of OpenLink Virtuoso are affected by CVE-2025-61028?

OpenLink Virtuoso Open Source Edition 7.2.11 contains a denial-of-service vulnerability capable of crashing the database server when processing malicious SQL statements.

How to fix or mitigate CVE-2025-61028?

Within 24 hours: Identify systems running OpenLink Virtuoso 7.2.11 and determine whether they accept untrusted SQL input or are accessible from untrusted networks. Within 7 days: Implement SQL input validation, enforce parameterized queries where feasible, and configure query execution timeouts (30-60 seconds) to interrupt long-running operations; enable connection rate limiting and comprehensive query logging. Within 30 days: Contact OpenLink for patch availability and supported upgrade paths; if no upgrade path exists, implement network segmentation to restrict database access to trusted systems only.

OpenLink Virtuoso CVE-2025-61028

EUVD-2025-210321 HIGH

SQL Injection (CWE-89)

2026-06-23 mitre

GHSA-496m-9pvr-rfmq

Denial Of Service SQLi N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Remotely reachable and low-complexity, but submitting SQL realistically needs a query session, so PR:L; impact is availability-only (A:H), no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 17:30 vuln.today

CVSS changed

Jun 25, 2026 - 15:22 NVD

7.5 (HIGH)

CVE Published

Jun 23, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in the time_t_to_dt component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

AnalysisAI

Denial of service in OpenLink Virtuoso Open Source Edition 7.2.11 lets attackers crash the database server by submitting crafted SQL statements that reach the time_t_to_dt date/time conversion routine. The defect is availability-only (no data exposure or integrity loss) and is tracked publicly via GitHub issue #1233; it carries a CVSS 3.1 base score of 7.5 but a low EPSS of 0.15% (4th percentile), and there is no public exploit identified at time of analysis and no evidence of active exploitation.

Technical ContextAI

Virtuoso is a hybrid relational/RDF database and middleware server from OpenLink Software, commonly used as a SPARQL triplestore and SQL engine. The fault lies in the internal time_t_to_dt component, which converts Unix time_t values into Virtuoso's internal datetime representation; a malformed or out-of-range value supplied through SQL appears to drive the function into an error state that terminates the process. The advisory is tagged CWE-89 (SQL Injection), but the described behavior is a server crash (denial of service) rather than query manipulation or injection of attacker SQL - the CWE assignment likely reflects the SQL delivery vector rather than the true root cause, which is closer to improper input validation / unhandled exceptional condition in datetime handling.

RemediationAI

No vendor-released patch identified at time of analysis - the only reference is upstream GitHub issue https://github.com/openlink/virtuoso-opensource/issues/1233, which tracks the bug but does not point to a tagged fixed release; monitor that issue and OpenLink's release notes for a patched build above 7.2.11 and upgrade once available. As compensating controls, restrict who can submit arbitrary SQL: do not expose the Virtuoso SQL/SPARQL endpoints directly to untrusted networks, place them behind a firewall or reverse proxy with allowlisting, and require authentication on all query interfaces (side effect: may break anonymous SPARQL consumers). Limit query privileges for application accounts and consider rate-limiting or query filtering at a proxy to blunt repeated crash attempts (side effect: added latency and operational complexity), and ensure process supervision/auto-restart is configured to reduce downtime from a crash.