CVE-2025-36001: 
IBM Db2 vulnerability analysis and mitigation

CVE-2025-36001 is an uncontrolled recursion vulnerability in IBM Db2 for Linux, UNIX and Windows (including Db2 Connect Server) that allows an authenticated user to cause a denial of service via a specially crafted SQL statement containing XML. Affected versions include 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 across all supported platforms. The vulnerability was published on January 30, 2026, with a patch made available shortly after. It carries a CVSS v3.1 base score of 6.5 (Medium) (IBM Support, Red Hat CVE).

The vulnerability is classified as CWE-674 (Uncontrolled Recursion) and resides in IBM Db2's XML processing subsystem. An authenticated attacker can submit a specially crafted SQL statement that includes XML content designed to trigger deeply nested or infinite recursion within the database engine. The attack vector is network-based, requires low privileges (valid database credentials), and no user interaction, making it straightforward to exploit once access is obtained. No complex preconditions beyond authentication are required (IBM Support, Red Hat CVE).

Successful exploitation results in a high availability impact — the affected Db2 instance can become unresponsive, crash, or consume excessive system resources, disrupting database service for all dependent applications and users. There is no confidentiality or integrity impact, as the vulnerability is limited to a denial-of-service condition. The scope is unchanged, meaning the impact is confined to the affected Db2 instance itself without lateral spread to other systems (IBM Support).

1. Reconnaissance: Identify IBM Db2 instances running versions 11.5.0–11.5.9 or 12.1.0–12.1.3 on Linux, UNIX, or Windows that are network-accessible.
2. Authentication: Obtain valid database credentials (low-privilege user account is sufficient) through credential theft, phishing, or brute force.
3. Craft malicious SQL: Construct a SQL statement that incorporates XML content designed to trigger deeply nested or infinite recursive processing within Db2's XML engine (e.g., using recursive XML structures or self-referencing XML entities).
4. Execute the payload: Submit the crafted SQL statement to the target Db2 instance via a database client, JDBC/ODBC connection, or any application interface that passes SQL to the database.
5. Achieve denial of service: The uncontrolled recursion causes the Db2 process to consume excessive CPU/memory resources or crash, rendering the database unavailable to legitimate users (IBM Support).

• Logs: Database audit logs showing repeated or unusual SQL statements containing deeply nested XML structures or recursive XML patterns submitted by a single user account.
• Process: Db2 engine processes exhibiting abnormally high CPU or memory consumption without corresponding legitimate workload.
• Availability: Sudden unresponsiveness or crashes of the Db2 service, particularly following execution of XML-containing SQL queries.
• Network: Unusual or repeated database connections from unexpected source IPs submitting XML-heavy SQL workloads.

IBM has released security patches for all affected versions; administrators should apply the updates referenced in IBM Support page node/7257616 for their specific version (11.5.0–11.5.9 or 12.1.0–12.1.3). As interim mitigations, restrict database access to only authenticated users who require it and enforce the principle of least privilege for database accounts. Additionally, monitor for and consider filtering SQL statements containing deeply nested or recursive XML structures, and review database audit logs for suspicious XML-based query patterns (IBM Support).