CVE-2025-36070: 
IBM Db2 vulnerability analysis and mitigation

CVE-2025-36070 is a denial-of-service vulnerability in IBM Db2 for Linux, UNIX, and Windows (including Db2 Connect Server) that allows an attacker to trigger a database trap (crash) by executing SELECT queries against certain types of tables. The vulnerability affects versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 across all supported platforms. It was published on January 30, 2026, with IBM releasing a patch shortly thereafter. The CVSS v3.1 base score is 7.5 (High) per NVD, though IBM's own scoring assigns 6.5 (Medium) with a low-privilege requirement (IBM Advisory, Red Hat CVE).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling), where the database engine fails to properly manage resource allocation when processing SELECT statements against specific table types, leading to an unhandled trap condition. The attack vector is network-based, requiring low-privilege authenticated access with no user interaction and low attack complexity. An attacker with valid database credentials can craft SELECT queries targeting the vulnerable table types to trigger the trap, causing the database instance to crash. No public proof-of-concept code has been identified at this time (IBM Advisory, Red Hat CVE).

Successful exploitation results in a complete loss of availability for the affected IBM Db2 instance, as the database process crashes (traps) and becomes unresponsive. There is no impact on confidentiality or data integrity — the vulnerability is purely a denial-of-service condition. Applications and services dependent on the affected Db2 instance would experience outages until the database is restarted, potentially disrupting critical business operations (IBM Advisory).

IBM has released patches addressing this vulnerability for both affected version branches. Administrators should upgrade IBM Db2 to a fixed version beyond 11.5.9 (for the 11.5.x branch) and beyond 12.1.3 (for the 12.1.x branch) by applying the updates referenced in IBM's security advisory. As interim mitigations, organizations should restrict database access to only authorized users with the minimum necessary privileges, implement network segmentation to limit remote access to Db2 servers, and monitor for unusual SELECT query patterns against atypical table types. The IBM support page provides specific fix pack details (IBM Advisory).