CVE-2025-36098: 
IBM Db2 vulnerability analysis and mitigation

CVE-2025-36098 is a denial-of-service vulnerability in IBM Db2 for Linux, UNIX and Windows (including Db2 Connect Server) caused by improper allocation of resources without limits or throttling. It affects versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 across Linux, UNIX, and Windows platforms. The vulnerability was published on January 30, 2026, with a patch available from IBM. It carries a CVSS v3.1 base score of 6.5 (Medium) (IBM Advisory, Red Hat CVE).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling), meaning the Db2 engine fails to enforce adequate caps on resource consumption during certain authenticated operations. An authenticated, low-privileged user can send crafted requests over the network that trigger uncontrolled resource allocation, exhausting system resources and causing the database service to crash or become unresponsive. No special configuration or elevated privileges beyond a valid database account are required to trigger the condition (IBM Advisory, Red Hat CVE).

Successful exploitation results in a denial-of-service condition affecting the availability of the IBM Db2 database service, rendering it unavailable to legitimate users and dependent applications. There is no impact on data confidentiality or integrity — attackers cannot read, modify, or exfiltrate data through this vulnerability. The scope is limited to the affected Db2 instance, with no evidence of lateral movement potential (IBM Advisory).

IBM has released patches addressing this vulnerability for both affected version branches. Administrators should apply the latest available fix packs for IBM Db2 11.5.x (beyond 11.5.9) and 12.1.x (beyond 12.1.3) as documented in the IBM support advisory. As interim mitigations, restrict database network access to trusted hosts and IP ranges, limit database credentials to only necessary personnel, and monitor Db2 resource utilization (CPU, memory, connections) for anomalous spikes that may indicate exploitation attempts (IBM Advisory).