CVE-2024-57655
Published: 14 January 2025
Description
An issue in the dfe_n_in_order component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
Security Summary
CVE-2024-57655 is a vulnerability in the dfe_n_in_order component of OpenLink Virtuoso Open-Source version 7.2.11. The issue enables attackers to trigger a Denial of Service (DoS) condition by sending crafted SQL statements, linked to CWE-400 (Uncontrolled Resource Consumption). It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity due to its potential for significant availability impact.
Remote attackers without authentication or privileges can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation leads to resource exhaustion, causing the affected Virtuoso instance to become unresponsive or crash, disrupting services for legitimate users.
Mitigation details and further information are available in the GitHub issue at https://github.com/openlink/virtuoso-opensource/issues/1216.
Details
- CWE(s)