CVE-2025-36071: 
IBM Db2 vulnerability analysis and mitigation

IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.2 is vulnerable to a denial of service vulnerability discovered in July 2025. The vulnerability allows the server to crash under certain conditions when processing specially crafted queries due to improper release of memory resources (NVD, IBM Advisory).

The vulnerability is classified as CWE-772 (Missing Release of Resource after Effective Lifetime). It has received a CVSS v3.1 Base Score of 7.5 (HIGH) from NVD with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, while IBM Corporation assigned a Base Score of 6.5 (MEDIUM) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can result in a denial of service condition where the Db2 server may crash when processing specially crafted queries. This impacts the availability of the database service, potentially disrupting business operations that depend on database access (IBM Advisory).

IBM has released special builds containing interim fixes for affected versions. For V11.5.9, users can apply Special Build #62071 or later, and for V12.1.1/12.1.2, Special Build #62100 or later is available. These builds can be applied to any affected mod pack level of the appropriate release. No workarounds are available, making patch installation the only mitigation option (IBM Advisory).