CVE-2025-61018

HIGH 7.5

Published 2026-06-23 · Last modified 2026-06-30

An issue in the sqlo_place_dt_set component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

ELEVATED IMPACT

Severe if exploited (CVSS 7.5), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.5%chance of exploitation in 30 days · 38th percentile

○ In CISA KEV ○ Public exploit / PoC

Impact if exploited

7.5CVSS 3.1 · HIGH

ConfidentialityNone
IntegrityNone
AvailabilityHigh

What an attacker needs

✓Access: Reachable over the network — no local access needed
✓Privileges: No account or privileges required
✓User interaction: No user interaction needed
✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Affected

Vendors Red Hat

Products Red Hat Enterprise Linux 7

Weakness (CWE)

CWE-89: SQL injection

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Technical & other

https://github.com/openlink/virtuoso-opensource/issues/1224
https://access.redhat.com/security/cve/CVE-2025-61018 vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2491820 issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61018.json x_sadp-csaf-vex

Sources: NVD · CVE.org · EPSS