# CVE-2025-61023: OpenLink Virtuoso OpenSource DoS in st_compare component

Source: https://junglewise.ai/threats/cve-2025-61023-openlink-virtuoso-opensource-dos-in-st-compare-component  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-23. Updated: 2026-06-23  
License: CC BY 4.0 with a link back

CVE-2025-61023 · Severity: info · CVSS 0 · Published 2026-06-23

OpenLink Virtuoso OpenSource is a high-performance database and middleware platform. A vulnerability in its SQL processing component allows an attacker to crash the database service by sending specifically crafted SQL commands. This results in a denial-of-service (DoS) condition, disrupting business operations and data availability until the service is restarted.

Technologies: [OpenLink Software Virtuoso OpenSource](https://junglewise.ai/threats/technologies/virtuoso-opensource). Vendors: [OpenLink Software](https://junglewise.ai/threats/vendors/openlink-software).

## Quick answers

**Is CVE-2025-61023 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-61023 being exploited in the wild.

**How severe is CVE-2025-61023?** Informational severity, with a CVSS score of 0, published 23 June 2026.

**Which products and versions are affected?** OpenLink Software Virtuoso OpenSource 7.2.11.

**Is there a fix for CVE-2025-61023?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-61023 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2025-61023?** Check whether you run OpenLink Software Virtuoso OpenSource at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the st_compare component of OpenLink Virtuoso OpenSource v7.2.11. The issue is triggered during the execution of complex SQL statements involving nested subqueries and GROUP BY CUBE operations, leading to a service crash (segmentation fault). The crash occurs within the sorting logic (sqlg_make_sort_nodes and qsort_r) when processing the malformed query. An attacker with the ability to execute SQL queries against the database can exploit this to cause a denial-of-service. The issue was identified via fuzzing and reported on the project's GitHub repository.

## Affected products

- OpenLink Virtuoso OpenSource 7.2.11

## Timeline

- 2024-01-07: disclosed: Issue reported on GitHub with PoC
- 2026-06-23: advisory: CVE published to NVD

## References

- [https://github.com/openlink/virtuoso-opensource/issues/1230](https://github.com/openlink/virtuoso-opensource/issues/1230)

## Related threats

- [OpenLink Virtuoso OpenSource Denial of Service in sqlo_untry](https://junglewise.ai/threats/cve-2025-61029-openlink-virtuoso-opensource-denial-of-service-in-sqlo-untry)
- [OpenLink Virtuoso OpenSource DoS in sqlo_try_in_loop](https://junglewise.ai/threats/cve-2025-61024-openlink-virtuoso-opensource-dos-in-sqlo-try-in-loop)
- [OpenLink Virtuoso OpenSource Denial of Service in time_t_to_dt](https://junglewise.ai/threats/cve-2025-61028-openlink-virtuoso-opensource-denial-of-service-in-time-t-to-dt)
- [OpenLink Virtuoso OpenSource Denial of Service in t_set_push](https://junglewise.ai/threats/cve-2025-61027-openlink-virtuoso-opensource-denial-of-service-in-t-set-push)
- [OpenLink Virtuoso OpenSource Denial of Service in sslr_qst_get](https://junglewise.ai/threats/cve-2025-61025-openlink-virtuoso-opensource-denial-of-service-in-sslr-qst-get)