CVE-2025-61028: Virtuoso Open Source DoS Vulnerability

CVE-2025-61028 Overview

CVE-2025-61028 is a denial-of-service vulnerability in OpenLink virtuoso-opensource version 7.2.11. The flaw resides in the time_t_to_dt component and can be triggered by crafted SQL statements sent to the database engine. Successful exploitation crashes the Virtuoso process and disrupts availability of the database and any applications depending on it. The vulnerability is reachable over the network and requires no authentication or user interaction. The issue is categorized under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated remote attackers can crash Virtuoso instances by submitting crafted SQL statements, causing service outage for dependent applications.

Affected Products

OpenLink virtuoso-opensource v7.2.11
Virtuoso deployments exposing SQL endpoints to untrusted clients
Applications and SPARQL/RDF services relying on the affected Virtuoso build

Discovery Timeline

2026-06-23 - CVE-2025-61028 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2025-61028

Vulnerability Analysis

The vulnerability lives in the time_t_to_dt routine, which converts a Unix time_t value into Virtuoso's internal datetime representation. When the conversion path is reached through specific SQL statements that produce out-of-range or malformed time inputs, the routine fails to validate boundaries before performing arithmetic and data conversion. The resulting error terminates the Virtuoso server process. Because Virtuoso exposes a network-facing SQL interface, any client able to submit a query can reach the vulnerable code path.

Root Cause

The root cause is improper handling of attacker-controlled input within time_t_to_dt. Crafted SQL statements pass values to the conversion routine that fall outside its supported range or violate format assumptions. The function does not sanitize or validate these values before processing, leading to an unrecoverable state and process termination. The issue is tracked in the upstream GitHub Issue Discussion.

Attack Vector

An attacker submits a malicious SQL statement to the Virtuoso SQL listener over the network. No authentication is required when the server permits anonymous query execution, and even authenticated low-privilege users can trigger the crash. The crafted statement invokes a code path that calls time_t_to_dt with hostile inputs, which forces the server to abort. Repeated submission of the request prevents service recovery and produces sustained denial of service.

The public CVE record does not include exploit code.
Refer to the upstream issue tracker for reproduction details:
https://github.com/openlink/virtuoso-opensource/issues/1233

Detection Methods for CVE-2025-61028

Indicators of Compromise

Unexpected Virtuoso server process crashes or restarts correlated with inbound SQL traffic
Error log entries referencing time_t_to_dt or datetime conversion failures
Spikes in client reconnection attempts following short-lived SQL sessions

Detection Strategies

Monitor Virtuoso server logs for repeated abnormal terminations and stack traces involving datetime conversion functions
Inspect SQL traffic for statements containing unusual time, datetime, or epoch-derived expressions targeting Virtuoso endpoints
Alert on rapid sequences of client SQL sessions terminated by server-side faults from a single source

Monitoring Recommendations

Enable verbose query logging on Virtuoso during triage to capture the offending SQL prior to a crash
Track process uptime and restart counts for the virtuoso-t daemon as a baseline health metric
Forward database and host logs to a centralized analytics platform to correlate crashes with network sources

How to Mitigate CVE-2025-61028

Immediate Actions Required

Restrict network access to the Virtuoso SQL listener so only trusted hosts can reach it
Disable anonymous SQL execution and enforce least-privilege accounts for application service users
Place a query gateway or proxy in front of Virtuoso to filter malformed datetime expressions

Patch Information

No vendor patch is referenced in the published CVE record at this time. Track the GitHub Issue Discussion for upstream remediation and apply a fixed build of virtuoso-opensource once OpenLink releases one beyond v7.2.11.

Workarounds

Block direct internet exposure of the Virtuoso SQL port using firewall rules or network ACLs
Require authentication and rate-limit SQL connections per client to slow exploitation attempts
Run Virtuoso under a process supervisor that restarts the service automatically after a crash to reduce outage duration

bash

# Example: restrict Virtuoso SQL port (1111) to a trusted subnet using iptables
iptables -A INPUT -p tcp --dport 1111 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 1111 -j DROP

# Example: ensure automatic restart via systemd override
mkdir -p /etc/systemd/system/virtuoso.service.d
cat > /etc/systemd/system/virtuoso.service.d/restart.conf <<EOF
[Service]
Restart=always
RestartSec=5
EOF
systemctl daemon-reload
systemctl restart virtuoso