CVE-2024-57635
Published: 14 January 2025
Description
An issue in the chash_array component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
Security Summary
CVE-2024-57635 is a vulnerability in the chash_array component of OpenLink Virtuoso Open-Source edition version 7.2.11. Published on 2025-01-14T01:15:12.047, it has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is classified under CWE-89. The flaw enables attackers to trigger a Denial of Service (DoS) condition through specially crafted SQL statements.
Unauthenticated attackers with network access to the vulnerable Virtuoso instance can exploit this issue. Exploitation requires low complexity and no user interaction, allowing remote parties to disrupt service availability by causing high-impact resource exhaustion, while confidentiality and integrity remain unaffected.
Mitigation details are available in the GitHub issue tracker at https://github.com/openlink/virtuoso-opensource/issues/1182.
Details
- CWE(s)