CVE-2025-61020: Virtuoso OpenSource DoS Vulnerability

CVE-2025-61020 Overview

CVE-2025-61020 is a denial of service vulnerability in OpenLink virtuoso-opensource version 7.2.11. The flaw resides in the sqlo_strip_in_join component of the SQL optimizer. Attackers can submit crafted SQL statements to crash the database service. The issue is tracked under [CWE-89] and carries network-based exploitability without authentication or user interaction.

Critical Impact
Remote unauthenticated attackers can trigger a denial of service in Virtuoso database instances by submitting malicious SQL queries, disrupting availability of dependent applications and services.

Affected Products

OpenLink Virtuoso Open Source v7.2.11
Virtuoso instances exposing SQL query interfaces to untrusted clients
Applications relying on Virtuoso as a backend RDF or SQL store

Discovery Timeline

2026-06-23 - CVE-2025-61020 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2025-61020

Vulnerability Analysis

The vulnerability exists in the sqlo_strip_in_join function within the Virtuoso SQL optimizer. This component processes IN clauses inside join operations during query planning. A crafted SQL statement causes the optimizer to enter an unsafe state, terminating the server process or rendering it unresponsive.

Virtuoso is widely deployed as both an SQL and SPARQL endpoint. A successful attack disrupts query processing for all connected clients. The CWE-89 classification indicates the root cause involves improper handling of SQL element composition during query transformation, although exploitation produces availability impact rather than data exfiltration.

Public reporting is available through GitHub Issue #1225. The EPSS data indicates a low near-term exploitation probability, and no public exploit code or CISA KEV entry exists at the time of publication.

Root Cause

The root cause is improper input handling within sqlo_strip_in_join when restructuring SQL expressions during join optimization. Specific syntactic patterns in the submitted query produce a fault condition the optimizer does not guard against, leading to process termination.

Attack Vector

The attack vector is network-based. An attacker with the ability to submit SQL queries to a Virtuoso endpoint sends a crafted statement targeting the optimizer path. No credentials are required when the SQL interface accepts unauthenticated queries, and no user interaction is needed.

The vulnerability is described in prose only. No verified proof-of-concept code is published. Refer to the upstream GitHub Issue #1225 for technical reproduction details.

Detection Methods for CVE-2025-61020

Indicators of Compromise

Unexpected termination or repeated restarts of the virtuoso-t process
Abnormal SQL query patterns containing complex IN clauses nested inside joins
Spikes in failed query responses or dropped client connections to the Virtuoso endpoint
Crash dumps or stack traces referencing sqlo_strip_in_join in Virtuoso server logs

Detection Strategies

Monitor Virtuoso server logs for crash signatures and abnormal optimizer errors
Inspect inbound SQL traffic for malformed or suspicious IN/JOIN constructs from untrusted sources
Correlate process restart events with preceding query activity to identify trigger statements

Monitoring Recommendations

Enable verbose query logging on Virtuoso endpoints exposed to untrusted networks
Alert on repeated virtuoso-t process exits within short time windows
Track query latency and error rate baselines to detect availability degradation early

How to Mitigate CVE-2025-61020

Immediate Actions Required

Restrict network access to Virtuoso SQL and SPARQL endpoints using firewalls or reverse proxies
Require authentication for all SQL query interfaces and disable anonymous access where possible
Apply input filtering at the application layer to reject malformed SQL constructs before they reach the database
Monitor the upstream GitHub Issue #1225 for fix availability and apply patches when released

Patch Information

At the time of NVD publication, no official patched release is referenced for virtuoso-opensource v7.2.11. Track the OpenLink Virtuoso repository and GitHub Issue #1225 for remediation commits and updated builds.

Workarounds

Place Virtuoso behind a query-aware proxy that validates SQL syntax before forwarding statements
Limit SQL endpoint exposure to trusted internal networks and VPN-protected segments
Implement rate limiting on SQL query interfaces to slow automated DoS attempts
Run Virtuoso under a process supervisor configured to restart the service after crashes while alerting operators

bash

# Configuration example: restrict Virtuoso listener to localhost in virtuoso.ini
[Parameters]
ServerPort                      = 1111
ServerThreads                   = 20
DisableUnixSocket               = 0
# Bind only to loopback to prevent external SQL access
ListenIP                        = 127.0.0.1