What is the CVSS score of EUVD-2025-210320?

EUVD-2025-210320 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of OpenLink Virtuoso are affected by EUVD-2025-210320?

OpenLink Virtuoso Open Source Edition 7.2.11 contains an unpatched vulnerability that could crash the database through malformed SQL queries, creating operational risk for dependent applications.

How to fix or mitigate EUVD-2025-210320?

24 hours: Complete inventory of all Virtuoso 7.2.11 instances in production and development; document criticality level and dependent applications. 7 days: Enforce role-based access controls (restrict direct SQL query submission to authenticated administrators only); implement query monitoring and rate limiting; establish automated database health checks with restart procedures. 30 days: Evaluate upgrade path to newer Virtuoso versions; submit inquiry to OpenLink Support for patch availability timeline and interim guidance.

OpenLink Virtuoso EUVD-2025-210320

| CVE-2025-61027 HIGH

SQL Injection (CWE-89)

2026-06-23 mitre

GHSA-94jw-xcff-qwrc

SQLi Denial Of Service N A Red Hat

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-reachable and low-complexity, but issuing arbitrary SQL realistically needs a valid session, so PR:L; impact is availability-only (process crash), hence C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 18:24 vuln.today

CVSS changed

Jun 25, 2026 - 18:22 NVD

7.5 (HIGH)

CVE Published

Jun 23, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in the t_set_push component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

AnalysisAI

Denial of service in OpenLink Virtuoso Open Source Edition 7.2.11 lets attackers crash the database engine by submitting crafted SQL statements that mishandle the internal t_set_push routine. The flaw carries availability-only impact (CVSS 7.5, A:H) with no confidentiality or integrity loss. EPSS is low (0.15%, 4th percentile), there is no public exploit identified at time of analysis, and it is not listed in CISA KEV - so risk is theoretical rather than actively exploited.

Technical ContextAI

Virtuoso is OpenLink's multi-model database and RDF triplestore (notably the engine behind DBpedia and many Linked Open Data endpoints), exposing a SQL/SPARQL query interface. The fault sits in the t_set_push component, an internal set/stack-management helper invoked during SQL statement processing, where a crafted query drives the engine into an unhandled state and aborts the process. MITRE classifies the root cause as CWE-89 (SQL Injection), but the realized impact is denial of service rather than data manipulation or query injection - the CWE mapping describes how the malicious SQL is delivered more than the actual memory/state failure it triggers, so the CWE should be treated as approximate.

RemediationAI

No vendor-released patch identified at time of analysis - the only reference is an open GitHub issue (openlink/virtuoso-opensource#1232), not a tagged release, PR, or commit, so monitor that issue and the project releases for a fixed build and upgrade to it once published. As compensating controls until a fix ships: restrict who can submit ad-hoc SQL by enforcing authentication on the Virtuoso SQL/ODBC/JDBC and HTTP SPARQL endpoints and revoking interactive SQL privileges from untrusted or application-only accounts (trade-off: may break tools that rely on direct SQL access); place the database behind network ACLs or a firewall so the listener (default port 1111, and the HTTP endpoint) is reachable only from trusted application tiers (trade-off: complicates legitimate remote administration); and front public SPARQL/SQL with a query gateway or proxy that constrains or validates statement shapes (trade-off: added latency and possible false rejections). Pair these with process supervision/auto-restart so a crash causes minimal downtime. Confirm details against the upstream issue at https://github.com/openlink/virtuoso-opensource/issues/1232.