Executive brief
OpenLink Virtuoso is a high-performance database and middleware solution used for managing large-scale data. A vulnerability in its SQL processing component allows an attacker to crash the database server by sending a specifically formatted database query. This results in a denial-of-service, making the database and any dependent applications unavailable to users.
Technical details
A vulnerability exists in the sqlo_strip_in_join component of OpenLink Virtuoso OpenSource v7.2.11. The issue is triggered during the optimization or execution phase of specific SQL statements involving nested IN clauses and aggregate functions (e.g., xmlagg). An attacker with the ability to execute SQL queries against the database can cause a NULL pointer dereference or similar memory corruption leading to a daemon crash. The vulnerability was identified via fuzzing and can be reproduced using a crafted UPDATE statement with a complex subquery. No patch is explicitly confirmed in the advisory, though it was reported via the project's GitHub issue tracker.
Affected products
- OpenLink Virtuoso OpenSource 7.2.11
Timeline
- 2024-01-07: disclosed: Issue reported on GitHub with PoC
- 2026-06-23: advisory: CVE published by NVD