CVE-2024-57663
Published: 14 January 2025
Description
An issue in the sqlg_place_dpipes component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
Security Summary
CVE-2024-57663 is a denial-of-service vulnerability affecting the sqlg_place_dpipes component in OpenLink Virtuoso Open-Source version 7.2.11. The issue enables attackers to disrupt service availability through specially crafted SQL statements. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is associated with CWE-770 (Allocation of Resources Without Limits or Throttling).
Unauthenticated remote attackers can exploit this vulnerability over the network with low attack complexity and no user interaction required. Exploitation leads to high-impact denial of service, potentially crashing the affected Virtuoso instance and rendering it unavailable, without impacting confidentiality or integrity.
Mitigation details are available in the referenced GitHub issue at https://github.com/openlink/virtuoso-opensource/issues/1218.
Details
- CWE(s)