OpenLink Virtuoso Parallel SQL Component Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in OpenLink Virtuoso Open Source version 7.2.11, specifically within the 'sqlg_parallel_ts_seq' component. This issue allows attackers to disrupt service by executing crafted SQL statements that exploit the vulnerability.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, causing the Virtuoso server to crash.

Reproduction

The vulnerability can be reproduced by creating a SQL file with a specific payload that exploits the 'sqlg_parallel_ts_seq' component. This payload can be executed using the 'isql' command-line interface after starting a Docker container with the vulnerable version of Virtuoso.

Remediation

Users can upgrade to OpenLink Virtuoso version 7.2.12 or later, where this vulnerability has been fixed.