Executive brief
OpenLink Virtuoso OpenSource is a high-performance database and middleware solution. A vulnerability in its SQL processing component allows an attacker to crash the database server by sending a specially crafted SQL statement. This results in a denial-of-service (DoS) condition, potentially disrupting business operations and data availability.
Technical details
A vulnerability exists in the sqlo_untry component of OpenLink Virtuoso OpenSource v7.2.11. The issue is triggered during the processing of complex, nested SQL statements (specifically within CREATE TABLE constraints or SELECT queries), leading to a null pointer dereference or similar memory corruption that causes the database process to crash. An attacker can exploit this by submitting a malformed SQL query over the network without requiring prior authentication. The root cause is located in the SQL optimizer/compiler logic (sqlo_untry), as evidenced by stack traces showing a crash during DDL constraint definition.
Affected products
- OpenLink Virtuoso OpenSource 7.2.11
Timeline
- 2024-01-07: disclosed: Issue reported on GitHub with PoC
- 2026-06-23: advisory: CVE published and NVD record created