CVE-2025-61021: Virtuoso Open-Source DoS Vulnerability

CVE-2025-61021 Overview

CVE-2025-61021 is a denial-of-service vulnerability affecting OpenLink Virtuoso OpenSource version 7.2.11. The flaw resides in the sqlo_natural_join_cond component of the SQL optimizer. Attackers can trigger the issue by submitting crafted SQL statements that cause the database server to terminate or hang. The result is service disruption for applications relying on Virtuoso as their backing data store.

The vulnerability requires the ability to send SQL queries to the affected instance. No authenticated remote code execution or data exfiltration has been reported. The issue is tracked publicly on the Virtuoso OpenSource GitHub issue tracker.

Critical Impact
A single crafted SQL statement processed by sqlo_natural_join_cond can render Virtuoso OpenSource v7.2.11 unavailable to legitimate users.

Affected Products

OpenLink Virtuoso OpenSource v7.2.11
sqlo_natural_join_cond SQL optimizer component
Applications and SPARQL endpoints backed by affected Virtuoso instances

Discovery Timeline

2026-06-23 - CVE-2025-61021 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2025-61021

Vulnerability Analysis

The defect lives in the sqlo_natural_join_cond function inside the Virtuoso SQL optimizer. This routine generates join conditions when processing NATURAL JOIN clauses. When the optimizer evaluates specific malformed or unexpected query shapes, it enters a faulty execution path that crashes the server process or exhausts available resources.

The published EPSS probability is 0.149%, placing the issue in the 4.5 percentile for likelihood of observed exploitation. Despite the low score, the trivial nature of triggering a DoS against a database engine elevates operational risk for internet-exposed instances.

Virtuoso is widely deployed as a SPARQL endpoint and relational backend. A successful attack interrupts both linked-data services and traditional SQL workloads sharing the same process.

Root Cause

The root cause is improper handling of input within the natural-join condition generator. The optimizer fails to validate query structure before constructing join predicates. This results in an unrecoverable error path inside sqlo_natural_join_cond and falls under the algorithmic input-validation class of denial-of-service flaws.

Attack Vector

An attacker submits a crafted SQL statement containing a NATURAL JOIN construct designed to reach the vulnerable optimizer path. Any client able to execute SQL against the Virtuoso instance can deliver the payload. This includes authenticated SQL clients, application connectors that forward user-controlled query fragments, and exposed administrative interfaces.

For a complete description of the malformed query shape, refer to the upstream issue report.

Detection Methods for CVE-2025-61021

Indicators of Compromise

Unexpected termination or restart of the virtuoso-t process correlated with recent SQL traffic
SQL error logs referencing sqlo_natural_join_cond or natural-join optimization failures
Repeated client submissions of NATURAL JOIN queries from a single source

Detection Strategies

Enable verbose query logging on Virtuoso and alert on optimizer crashes referencing the affected function
Inspect application-layer SQL telemetry for malformed or anomalous NATURAL JOIN constructs
Correlate database process restarts with preceding client IP and query identifiers to attribute DoS attempts

Monitoring Recommendations

Monitor virtuoso-t process uptime and memory consumption with infrastructure observability tooling
Track HTTP and ODBC error rates from applications fronting the database for sudden spikes
Forward Virtuoso logs to a centralized log platform for retention and behavioral analysis

How to Mitigate CVE-2025-61021

Immediate Actions Required

Restrict network access to Virtuoso SQL and SPARQL endpoints to trusted hosts only
Require authentication for all SQL clients and disable anonymous query submission where possible
Review application code that forwards user-supplied SQL fragments and add structural validation

Patch Information

At the time of publication, no vendor patch reference is listed in the NVD entry for CVE-2025-61021. Monitor the Virtuoso OpenSource GitHub repository for fix releases and apply updates beyond v7.2.11 as soon as they are available.

Workarounds

Block or sanitize NATURAL JOIN clauses at the application layer until a fixed release is deployed
Place Virtuoso behind a database proxy or web application firewall that inspects SQL syntax
Implement query timeouts and process supervision so the service restarts quickly after a crash

bash

# Example: restrict Virtuoso listener to localhost in virtuoso.ini
[Parameters]
ServerPort = 127.0.0.1:1111
HTTPServerPort = 127.0.0.1:8890