# CVE-2025-61029: OpenLink Virtuoso OpenSource Denial of Service in sqlo_untry

Source: https://junglewise.ai/threats/cve-2025-61029-openlink-virtuoso-opensource-denial-of-service-in-sqlo-untry  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-23. Updated: 2026-06-23  
License: CC BY 4.0 with a link back

CVE-2025-61029 · Severity: high · CVSS 7.5 · Published 2026-06-23

OpenLink Virtuoso OpenSource is a high-performance database and middleware solution. A vulnerability in its SQL processing component allows an attacker to crash the database server by sending a specially crafted SQL statement. This results in a denial-of-service (DoS) condition, potentially disrupting business operations and data availability.

Technologies: [OpenLink Software Virtuoso OpenSource](https://junglewise.ai/threats/technologies/virtuoso-opensource). Vendors: [OpenLink Software](https://junglewise.ai/threats/vendors/openlink-software).

## Quick answers

**Is CVE-2025-61029 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-61029 being exploited in the wild.

**How severe is CVE-2025-61029?** High severity, with a CVSS score of 7.5, published 23 June 2026.

**Which products and versions are affected?** OpenLink Software Virtuoso OpenSource 7.2.11.

**Is there a fix for CVE-2025-61029?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-61029 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-61029?** Check whether you run OpenLink Software Virtuoso OpenSource at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the sqlo_untry component of OpenLink Virtuoso OpenSource v7.2.11. The issue is triggered during the processing of complex, nested SQL statements (specifically within CREATE TABLE constraints or SELECT queries), leading to a null pointer dereference or similar memory corruption that causes the database process to crash. An attacker can exploit this by submitting a malformed SQL query over the network without requiring prior authentication. The root cause is located in the SQL optimizer/compiler logic (sqlo_untry), as evidenced by stack traces showing a crash during DDL constraint definition.

## Affected products

- OpenLink Virtuoso OpenSource 7.2.11

## Timeline

- 2024-01-07: disclosed: Issue reported on GitHub with PoC
- 2026-06-23: advisory: CVE published and NVD record created

## References

- [https://github.com/openlink/virtuoso-opensource/issues/1228](https://github.com/openlink/virtuoso-opensource/issues/1228)

## Related threats

- [OpenLink Virtuoso OpenSource DoS in sqlo_try_in_loop](https://junglewise.ai/threats/cve-2025-61024-openlink-virtuoso-opensource-dos-in-sqlo-try-in-loop)
- [OpenLink Virtuoso OpenSource Denial of Service in time_t_to_dt](https://junglewise.ai/threats/cve-2025-61028-openlink-virtuoso-opensource-denial-of-service-in-time-t-to-dt)
- [OpenLink Virtuoso OpenSource Denial of Service in t_set_push](https://junglewise.ai/threats/cve-2025-61027-openlink-virtuoso-opensource-denial-of-service-in-t-set-push)
- [OpenLink Virtuoso OpenSource Denial of Service in sslr_qst_get](https://junglewise.ai/threats/cve-2025-61025-openlink-virtuoso-opensource-denial-of-service-in-sslr-qst-get)
- [OpenLink Virtuoso OpenSource DoS in st_compare component](https://junglewise.ai/threats/cve-2025-61023-openlink-virtuoso-opensource-dos-in-st-compare-component)