CVE-2025-61018: OpenLink Virtuoso DoS Vulnerability

CVE-2025-61018 Overview

CVE-2025-61018 is a denial-of-service vulnerability in OpenLink virtuoso-opensource v7.2.11. The flaw resides in the sqlo_place_dt_set component of the SQL optimizer. Attackers can submit crafted SQL statements that cause the database server to crash or become unresponsive. The issue is categorized under CWE-89 and is exploitable over the network without authentication or user interaction.

Critical Impact
Unauthenticated remote attackers can trigger a denial of service against Virtuoso database servers by sending crafted SQL queries, disrupting availability of dependent applications and RDF/SPARQL services.

Affected Products

OpenLink virtuoso-opensource v7.2.11
Earlier v7 branch releases that share the affected sqlo_place_dt_set code path
Applications and SPARQL endpoints backed by vulnerable Virtuoso instances

Discovery Timeline

2026-06-23 - CVE-2025-61018 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2025-61018

Vulnerability Analysis

The vulnerability exists in the sqlo_place_dt_set function within the Virtuoso SQL optimizer. This component participates in placing derived table sets during query planning. A malformed or specifically crafted SQL statement reaches the function in an unexpected state, causing the server process to terminate or hang. Because Virtuoso runs as a multi-threaded server handling concurrent client sessions, a crash affects all active connections and dependent SPARQL and RDF workloads. The vulnerability is tracked under CWE-89, reflecting improper neutralization of elements within SQL processing logic.

Root Cause

The root cause is improper handling of SQL parser or optimizer state inside sqlo_place_dt_set when processing crafted statements. The function does not validate or constrain input conditions before operating on derived table structures, leading to an unrecoverable error condition. Confidentiality and integrity are not impacted, but availability is fully compromised.

Attack Vector

Attackers exploit the flaw over the network by sending a crafted SQL statement to an exposed Virtuoso SQL or SPARQL endpoint. No privileges or user interaction are required when query interfaces are reachable. Public-facing Linked Data endpoints and shared development databases are most exposed. Refer to the upstream GitHub Issue Report for proof-of-concept query details.

No verified exploit code is published in this advisory. The vulnerability is described in prose because no sanitized exploit example has been validated.

Detection Methods for CVE-2025-61018

Indicators of Compromise

Unexpected Virtuoso server process crashes or restarts correlated with inbound SQL traffic
Repeated abnormal termination entries in virtuoso.log referencing the SQL optimizer
Spikes in failed query responses or dropped client connections on TCP port 1111 or HTTP SPARQL endpoints
Inbound SQL statements containing unusual derived table constructs from untrusted clients

Detection Strategies

Monitor Virtuoso log files for parser or optimizer fault messages and segmentation faults
Enable SQL query auditing to capture statements submitted prior to service interruption
Deploy network IDS signatures that flag malformed SQL targeting Virtuoso listener ports
Track process supervisor restarts of virtuoso-t as a high-fidelity availability signal

Monitoring Recommendations

Alert on Virtuoso service unavailability with sub-minute polling against health endpoints
Forward database and host logs to a centralized SIEM and correlate crashes with source IP addresses
Baseline normal SPARQL and SQL query volumes to detect query-flood or crash-loop patterns

How to Mitigate CVE-2025-61018

Immediate Actions Required

Restrict network access to Virtuoso SQL and SPARQL endpoints using firewall rules or reverse proxy allow-lists
Require authentication on all query interfaces and disable anonymous SQL execution where feasible
Place public SPARQL endpoints behind a query-validating gateway that rejects malformed statements
Monitor the GitHub Issue Report for upstream patch availability

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Track the upstream repository at openlink/virtuoso-opensource for commits that modify sqlo_place_dt_set and apply fixed releases as soon as they are published. Organizations building from source should rebuild against the patched branch and validate query workloads in staging before production rollout.

Workarounds

Block external access to Virtuoso ports 1111 and HTTP SPARQL listeners from untrusted networks
Use a query proxy or WAF rule set to filter SQL statements containing suspicious derived table syntax
Run Virtuoso under a process supervisor such as systemd with automatic restart to reduce outage duration
Isolate Virtuoso instances in dedicated containers or VMs to limit blast radius from a crash

bash

# Configuration example: restrict Virtuoso listener and enforce supervisor restart
# /etc/virtuoso/virtuoso.ini
[Parameters]
ServerPort = 127.0.0.1:1111
DisableUnixSocket = 0

# /etc/systemd/system/virtuoso.service
[Service]
ExecStart=/usr/bin/virtuoso-t +foreground +configfile /etc/virtuoso/virtuoso.ini
Restart=always
RestartSec=5