CVE-2025-36009: 
IBM Db2 vulnerability analysis and mitigation

CVE-2025-36009 is a denial-of-service vulnerability in IBM Db2 for Linux, UNIX, and Windows (including DB2 Connect Server) caused by excessive use of a global variable. It affects versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 across Linux, UNIX, and Windows platforms. The vulnerability was published on January 30, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (IBM Advisory, Red Hat CVE). Note: There is a discrepancy between sources — the NVD/Red Hat description references an authenticated user, while the ENISA/EUVD entry describes the attacker as unauthenticated.

The root cause is classified under CWE-1108 (Excessive Reliance on Global Variables) and CWE-1284 (Improper Validation of Specified Quantity in Input). An attacker can send crafted network requests that cause IBM Db2 to excessively consume a global variable, ultimately exhausting resources and crashing database services. The attack vector is network-based with low attack complexity, requiring low privileges (per NVD) or no authentication (per EUVD), and no user interaction (IBM Advisory, Red Hat CVE). No public proof-of-concept exploit code has been identified.

Successful exploitation results in a denial of service, causing the IBM Db2 database service to become unavailable. There is no impact on confidentiality or data integrity — the vulnerability is limited to availability (HIGH). Organizations relying on Db2 for critical database operations could experience significant service disruption, potentially affecting dependent applications and business processes (IBM Advisory).

IBM has released patches addressing this vulnerability. Users should upgrade IBM Db2 to a fixed version beyond 11.5.9 (for the 11.5.x line) or beyond 12.1.3 (for the 12.1.x line) as directed in the IBM support advisory. Administrators should apply the relevant fix pack or interim fix as documented by IBM and restrict network access to Db2 services to trusted hosts as a defense-in-depth measure (IBM Advisory).