Executive brief
OpenLink Virtuoso OpenSource is a high-performance database and middleware solution. A vulnerability in its SQL processing component allows an attacker to crash the database service by sending specifically crafted SQL commands. This results in a denial-of-service (DoS) condition, potentially disrupting business operations and data availability.
Technical details
A Denial of Service (DoS) vulnerability exists in OpenLink Virtuoso OpenSource v7.2.11 within the 'sqlo_place_dt_set' component. The issue is triggered during the compilation or execution phase of specific SQL statements involving nested subqueries and UNION operations (e.g., UPDATE statements with complex WHERE clauses). An attacker with the ability to execute SQL queries against the database can cause a NULL pointer dereference or similar memory corruption leading to a process crash. The vulnerability was identified via fuzzing and can be reproduced using a specific sequence of CREATE TABLE and UPDATE statements.
Affected products
- OpenLink Virtuoso OpenSource 7.2.11
Timeline
- 2024-01-07: disclosed: Issue reported on GitHub repository
- 2026-06-23: advisory: CVE published to NVD dataset