Executive brief
OpenLink Virtuoso is a high-performance database and middleware platform used for managing large-scale data. A vulnerability in its SQL processing component allows an attacker to crash the database server by sending a specifically crafted SQL command. This results in a denial-of-service (DoS) condition, disrupting business operations and data availability until the service is manually restarted.
Technical details
A vulnerability exists in the t_set_push component of OpenLink Virtuoso OpenSource v7.2.11. The issue is triggered during the compilation or execution phase of complex SQL statements involving specific subqueries, CROSS JOINs, and date arithmetic (as demonstrated in the provided PoC). When the engine processes these crafted statements, it triggers a null pointer dereference or similar memory corruption leading to a process crash (SIGSEGV). An attacker with the ability to execute SQL queries against the database can exploit this to cause a persistent Denial of Service. The issue was identified via fuzzing and reported on the project's GitHub repository.
Affected products
- OpenLink Virtuoso OpenSource 7.2.11
Timeline
- 2024-01-07: disclosed: Issue reported on GitHub with PoC
- 2026-06-23: advisory: CVE published to NVD