CVE-2025-36136: 
IBM Db2 vulnerability analysis and mitigation

IBM Db2 versions 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes DB2 Connect Server) contains a vulnerability that was disclosed on November 7, 2025. The vulnerability allows a local user to cause a denial of service due to the database monitor script incorrectly detecting that the instance is still starting under specific conditions (IBM Security Bulletin).

The vulnerability has been assigned a CVSS v3.1 Base Score of 5.1 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. The weakness has been categorized as CWE-770: Allocation of Resources Without Limits or Throttling. The vulnerability specifically affects Linux and Unix systems, while Windows systems are not impacted (IBM Security Bulletin).

If exploited, this vulnerability could allow a local user to cause a denial of service in the IBM Db2 database system. The impact is limited to availability (A:H) with no effect on confidentiality (C:N) or integrity (I:N) (IBM Security Bulletin).

IBM has released special builds containing interim fixes for affected versions. For V11.5.9, users can apply Special Build #69673 or later, and for V12.1.2, Special Build #70120 or later is available. As a workaround, users should ensure no other process is accessing or viewing the db2V115_start.ksh script by its full path, or has the instance name in its command line with the script (IBM Security Bulletin).