OpenLink Virtuoso-Opensource Denial-of-Service Vulnerability in SQL Tree Hash Component

A denial-of-service vulnerability has been identified in OpenLink Virtuoso-Opensource version 7.2.11. The issue arises in the SQL tree hash component, where attackers can cause a service disruption by sending crafted SQL statements. This vulnerability can be reproduced using the Virtuoso Docker image.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, causing the Virtuoso server to crash.

Reproduction

The vulnerability can be reproduced by creating a SQL table and then executing a SELECT statement that includes a crafted SQL condition. This can be done using the Virtuoso command-line interface (isql) after starting a Virtuoso server instance in a Docker container.