CVE-2025-61028: OpenLink Virtuoso DoS Vulnerability in time_t_to_dt Component

Technical summary

CVE-2025-61028 is a denial-of-service vulnerability in the time_t_to_dt conversion function within OpenLink Virtuoso Open Source v7.2.11. The flaw stems from improper input validation in SQL statement processing, allowing an unauthenticated network attacker to submit malformed queries that cause the service to become unresponsive. The vulnerability is classified as CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-89 (SQL Injection), indicating both resource exhaustion and potential SQL injection vectors as attack primitives. With a CVSS 3.1 score of 7.5 (HIGH severity), the attack vector is network-accessible, requires no privileges or user interaction, and causes complete loss of availability.

Business impact

An active exploitation of this vulnerability would render Virtuoso database instances unavailable to legitimate users and applications, causing service disruptions, operational downtime, and potential data access delays. Organizations relying on Virtuoso for critical data storage, reporting, or API backends would experience immediate operational impact. Recovery requires manual intervention to restart affected database services, extending recovery time objectives (RTO) and increasing incident response costs.

Affected systems

OpenLink Virtuoso Open Source version 7.2.11 is confirmed vulnerable. Organizations using this specific version should inventory instances immediately. Verify whether your deployment is on v7.2.11 or a patched version by checking SHOW SYSTEM_INFO output or version information in the Virtuoso control panel. Older and newer versions should be validated against the vendor advisory to determine scope.

Exploitability

Exploitation requires only network connectivity and the ability to submit SQL statements—no authentication or user interaction is required. Any network-accessible Virtuoso instance running the affected version is immediately at risk. Public internet-facing deployments, internal databases with permissive firewall rules, and development environments are all potential targets. The attack is straightforward to execute; attackers need only craft and submit the triggering SQL payload.

Remediation

Upgrade OpenLink Virtuoso Open Source to a patched version released after this vulnerability's disclosure. Verify the specific patch version from the official OpenLink Virtuoso vendor advisory. Until patching is possible, implement network-level access controls to restrict SQL connections to trusted internal networks or known application servers, and monitor for suspicious SQL query patterns that might indicate exploitation attempts.

Patch guidance

Consult the official OpenLink Virtuoso release notes and security advisories to identify the specific patched version addressing CVE-2025-61028. Apply patches during a scheduled maintenance window after thorough testing in a non-production environment. Verify successful remediation by confirming the installed version matches or exceeds the minimum patched release and by re-testing with known crafted SQL inputs in a controlled lab setting.

Detection guidance

Monitor database logs for SQL statements containing unusual time_t_to_dt function calls or malformed temporal data conversions that correlate with service crashes or restarts. Track unexpected database shutdowns or high CPU utilization followed by service unavailability. Network-level detection can flag repeated failed connection attempts or unusual query patterns from untrusted sources. Establish baseline logging for SQL syntax errors and anomalous query structures.

Why prioritize this

This vulnerability merits immediate attention due to its high CVSS score (7.5), unauthenticated network exploitability, and direct impact on service availability. Even though it does not enable data theft or system compromise, the ability for any remote attacker to knock a critical database offline makes it a significant operational risk. Organizations should treat this as a high-priority remediation candidate alongside other availability-impacting flaws.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects a high-severity DoS condition that is trivially exploitable (network vector, no authentication, low complexity) but limited in scope to availability impact. The absence of confidentiality or integrity impact prevents a critical rating, but the ease of exploitation and direct service disruption justify the high classification.

Frequently asked questions