CVE-2025-36123: 
IBM Db2 vulnerability analysis and mitigation

CVE-2025-36123 is a denial-of-service vulnerability in IBM Db2 for Linux, UNIX, and Windows (including DB2 Connect Server) caused by improper allocation of system resources when copying large tables containing XML data. It affects versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3. The vulnerability was published on January 30, 2026, with a patch available via IBM's support portal. It carries a CVSS v3.1 base score of 5.5 (Medium) (IBM Support, Red Hat CVE).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling), where the Db2 engine fails to properly bound or throttle system resource consumption during large XML table copy operations. A local user with low privileges can trigger the flaw by initiating a copy of a large table containing XML data, causing the database process to exhaust system resources without adequate controls. No user interaction is required, and the attack complexity is low, making it straightforward for any authenticated local user to trigger. No public technical write-ups or proof-of-concept code have been identified (IBM Support, Red Hat CVE).

Successful exploitation results in a denial of service, disrupting availability of the IBM Db2 database instance by exhausting system resources. There is no impact on data confidentiality or integrity — the vulnerability is limited to availability. The scope is confined to the affected Db2 instance, with no evidence of lateral movement potential or data exposure risk (IBM Support).

IBM has released patches addressing this vulnerability; users should upgrade IBM Db2 11.5.x to a version beyond 11.5.9 and IBM Db2 12.1.x to a version beyond 12.1.3. Patch details and download instructions are available on the IBM support page. As an interim measure, administrators should implement access controls to restrict which local users can perform large table copy operations involving XML data, and monitor Db2 processes for unusual resource consumption patterns (IBM Support).