CVE-2024-57664

What it actually does

The flaw in the sqlg_group_node component permits crafted SQL statements to trigger a denial of service condition against the database server.

Why it matters to the business

Results in unplanned database downtime that can interrupt dependent applications and services until the instance is restarted.

How an attack unfolds

An attacker with SQL execution access submits specially crafted statements targeting sqlg_group_node to induce the crash or hang; no named threat actors or campaigns are associated with this issue.

How to fix it

Upgrade the affected software to a fixed release; for the listed packages apply webkit2gtk updates to version 2.14.2-0ubuntu0.16.04.1 on Ubuntu 16.04 LTS.

How to confirm the fix worked

Confirm the installed package version matches or exceeds the fixed release and test that previously triggering SQL statements no longer cause denial of service.

Typical attack path

1. Locate an accessible Virtuoso instance
2. Obtain ability to submit SQL statements
3. Send crafted SQL payload against sqlg_group_node
4. Observe server crash or unresponsiveness

How to detect it

Review database query logs and error logs for repeated malformed statements or sudden server restarts; no specific threat actor indicators are known.

What your security team should do

• Apply the listed fixed package versions immediately
• Restrict direct SQL access to trusted principals only
• Monitor for unusual query patterns that could precede DoS attempts