Executive brief
OpenLink Virtuoso is a high-performance database and middleware platform used for managing large-scale data. A vulnerability in its SQL processing engine allows an attacker to crash the database service by sending specifically crafted database queries. This results in a denial-of-service (DoS) condition, potentially disrupting business operations and data availability until the service is manually restarted.
Technical details
A Denial of Service (DoS) vulnerability exists in OpenLink Virtuoso OpenSource v7.2.11 within the sqlo_natural_join_cond component. The issue is triggered during the compilation or execution of complex SQL statements involving NATURAL JOIN operations, subqueries, and specific table references. An attacker with the ability to execute SQL queries (authenticated user) can provide a crafted statement that causes a null pointer dereference or similar memory corruption, leading to a daemon crash. The vulnerability was identified via fuzzing and confirmed in the 7.2.11 release and associated Docker images. No official patch was explicitly detailed in the advisory, though it was reported via the project's GitHub issue tracker.
Affected products
- OpenLink Virtuoso OpenSource 7.2.11
Timeline
- 2024-01-07: disclosed: Issue reported on GitHub by fuboat
- 2026-06-23: advisory: CVE published to NVD