OpenLink Virtuoso Denial-of-Service Vulnerability in dfe_n_in_order Component

A denial-of-service vulnerability has been identified in OpenLink Virtuoso Open Source version 7.2.11. The issue arises in the dfe_n_in_order component, where attackers can cause a crash by sending specially crafted SQL statements. This vulnerability can be reproduced using the beta Docker image of Virtuoso 7.2.11.

Impact

Exploitation of this vulnerability leads to a crash of the Virtuoso database server, causing a denial-of-service condition where the server becomes unresponsive or unavailable.

Reproduction

The vulnerability can be reproduced by creating a SQL table and then executing an update statement that includes a complex case expression. This crafted SQL statement can be run using the isql command-line interface, which connects to the Virtuoso database server. The issue has been documented as GitHub Issue #1216.