CVE-2025-61025: Virtuoso OpenSource DoS Vulnerability

CVE-2025-61025 Overview

CVE-2025-61025 is a denial of service vulnerability in OpenLink virtuoso-opensource v7.2.11. The flaw resides in the sslr_qst_get component and can be triggered by crafted SQL statements sent to the database engine. A remote, unauthenticated attacker can issue malicious queries that cause the Virtuoso process to crash or become unresponsive. The issue is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command) and is tracked in the upstream GitHub Issue Report.

Critical Impact
Unauthenticated network attackers can disrupt availability of Virtuoso database services by submitting crafted SQL statements to the sslr_qst_get code path.

Affected Products

OpenLink Virtuoso Open Source (virtuoso-opensource) v7.2.11
Deployments exposing the Virtuoso SQL endpoint to untrusted clients
Applications and SPARQL/RDF services backed by the affected Virtuoso build

Discovery Timeline

2026-06-23 - CVE-2025-61025 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2025-61025

Vulnerability Analysis

The defect lives in the sslr_qst_get routine of Virtuoso's SQL processing layer. When the server receives a specially crafted SQL statement, the function mishandles input state during query parameter retrieval, leading to an abnormal termination of the database process. Because Virtuoso typically runs as a long-lived multi-tenant service, a single malicious request can sever connections for all active clients. The CWE-89 classification reflects that the trigger involves SQL syntax handled by the engine, although the observable impact is loss of availability rather than data manipulation. EPSS for this issue currently sits at 0.35%, indicating low observed exploitation activity at this time.

Root Cause

The root cause is improper handling of attacker-controlled SQL input inside sslr_qst_get. The component does not adequately validate query state before dereferencing or processing the supplied statement, which permits an error condition that propagates to a process-level fault. No authentication or user interaction is required to reach the vulnerable code path when the SQL endpoint is reachable.

Attack Vector

The attack vector is network-based. An attacker connects to the Virtuoso SQL service and submits a crafted statement designed to traverse the sslr_qst_get path. Successful exploitation results in service disruption rather than code execution or data disclosure. Detailed reproduction steps and the proof-of-concept query are documented in the upstream GitHub Issue Report.

Detection Methods for CVE-2025-61025

Indicators of Compromise

Unexpected termination or restart of the virtuoso-t process with no operator action.
Crash dumps or stack traces referencing sslr_qst_get in Virtuoso server logs.
Spikes in failed SQL sessions or abrupt client disconnects from a single source IP.

Detection Strategies

Monitor Virtuoso logs for repeated abnormal exits and correlate against inbound SQL session metadata.
Inspect network telemetry for anomalous SQL traffic targeting the Virtuoso listener from untrusted hosts.
Alert on process crash events for virtuoso-t followed by automatic service restarts within short time windows.

Monitoring Recommendations

Track service availability metrics for the Virtuoso endpoint and alert on uptime regressions.
Forward Virtuoso application logs and host process events to a central log platform for retention and search.
Baseline normal SQL query volume per client and flag deviations that align with crash events.

How to Mitigate CVE-2025-61025

Immediate Actions Required

Restrict network access to the Virtuoso SQL listener using firewall rules or security groups so only trusted clients can connect.
Place authenticated reverse proxies or application gateways in front of Virtuoso to filter direct client access.
Review the upstream GitHub Issue Report and track the maintainer response for a fixed release.

Patch Information

At the time of publication, no fixed version is referenced in the NVD entry for CVE-2025-61025. Administrators should monitor the OpenLink virtuoso-opensource repository for a release that resolves the sslr_qst_get defect and upgrade once available. Until a patch ships, treat any Virtuoso v7.2.11 deployment exposed to untrusted networks as at risk of induced outages.

Workarounds

Limit SQL endpoint exposure to internal management networks or VPN-only access.
Enforce authentication and least-privilege accounts for all clients permitted to issue SQL statements.
Apply rate limiting and connection throttling at the network layer to slow repeated crash attempts.
Configure process supervision so virtuoso-t restarts automatically after a fault to reduce outage duration.

bash

# Example: restrict Virtuoso SQL port (default 1111) to a trusted subnet using iptables
iptables -A INPUT -p tcp --dport 1111 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 1111 -j DROP