CVE-2025-61023: Virtuoso OpenSource DoS Vulnerability

CVE-2025-61023 Overview

CVE-2025-61023 is a denial of service vulnerability in the st_compare component of OpenLink virtuoso-opensource version 7.2.11. Attackers can trigger the condition by submitting crafted SQL statements to the database engine. Successful exploitation causes the Virtuoso process to terminate or become unresponsive, disrupting database availability for downstream applications.

Virtuoso is a hybrid database engine that supports relational, RDF, and graph data, often deployed as a backend for knowledge graphs and Linked Data services. A disruption to the Virtuoso process affects every workload that depends on it.

Critical Impact
Authenticated or unauthenticated attackers able to submit SQL statements can crash the Virtuoso database server, breaking availability for dependent services.

Affected Products

OpenLink virtuoso-opensource v7.2.11
Deployments using the st_compare SQL function path
Downstream applications relying on affected Virtuoso instances

Discovery Timeline

2026-06-23 - CVE-2025-61023 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2025-61023

Vulnerability Analysis

The defect resides in the st_compare routine, which Virtuoso uses while processing certain SQL expressions. A specially crafted SQL statement drives st_compare into an unsafe state that aborts the server process. The result is a denial of service against the database engine.

Because the trigger is a SQL statement, any client with the ability to submit queries through the SQL endpoint, ODBC, JDBC, or SPARQL bridge can reach the vulnerable code path. Multi-tenant or internet-exposed Virtuoso instances are at elevated risk.

The public report tracking this issue is available at GitHub Issue #1230.

Root Cause

The root cause is improper handling of attacker-controlled input inside st_compare. The function does not validate operand state or type assumptions before performing the comparison, leading to a fatal error in the server process. This pattern aligns with input validation and resource handling weaknesses that produce denial of service conditions.

Attack Vector

An attacker submits a crafted SQL statement to a reachable Virtuoso instance. The query reaches the st_compare code path during evaluation, the process enters an unrecoverable state, and the database service stops responding. No memory corruption or code execution has been documented in the public report. The vulnerability mechanism is described in GitHub Issue #1230; no verified proof-of-concept code is reproduced here.

Detection Methods for CVE-2025-61023

Indicators of Compromise

Unexpected termination or restart of the virtuoso-t process on affected hosts
Crash dumps or core files referencing st_compare in the call stack
Gaps in Virtuoso query logs followed by service restart entries
Spikes in failed client connections to ports 1111 or 8890

Detection Strategies

Monitor Virtuoso server logs for abnormal shutdown sequences and assertion failures
Correlate SQL query logs with process crash events to identify the triggering statement
Alert on repeated client submissions that precede service restarts from the same source address

Monitoring Recommendations

Track process uptime and restart counts for virtuoso-t with host telemetry
Capture inbound SQL and SPARQL query patterns at the application gateway for retrospective analysis
Forward Virtuoso logs to a central log platform and alert on crash signatures referencing st_compare

How to Mitigate CVE-2025-61023

Immediate Actions Required

Restrict network access to Virtuoso SQL and SPARQL endpoints to trusted clients only
Require authentication for all SQL endpoints and remove anonymous query access where possible
Review and revoke unnecessary query privileges from low-trust database accounts
Enable automatic process supervision so that a crash triggers a controlled restart

Patch Information

No vendor-published patch is referenced in the available CVE data at the time of writing. Track the upstream issue at GitHub Issue #1230 for fix availability and upgrade beyond virtuoso-opensource v7.2.11 once a corrected release is published.

Workarounds

Place Virtuoso behind a query proxy that validates and filters incoming SQL before it reaches the engine
Block external access to administrative SQL ports at the network boundary
Use database firewall rules to limit query patterns to those required by the application
Run Virtuoso under a service manager such as systemd so crashes do not produce extended outages

bash

# Example: restrict Virtuoso SQL port to a trusted application subnet
iptables -A INPUT -p tcp --dport 1111 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 1111 -j DROP

# Example: ensure automatic restart on crash via systemd override
mkdir -p /etc/systemd/system/virtuoso.service.d
cat <<EOF > /etc/systemd/system/virtuoso.service.d/restart.conf
[Service]
Restart=always
RestartSec=5
EOF
systemctl daemon-reload
systemctl restart virtuoso