CVE-2025-36366: 
IBM Db2 vulnerability analysis and mitigation

CVE-2025-36366 is a denial-of-service vulnerability in IBM Db2 for Linux, UNIX, and Windows (including Db2 Connect Server) caused by improper neutralization of special elements in data query logic. An authenticated user can trigger an unhandled exception by executing a query that invokes the JSON_Object scalar function, resulting in abnormal server termination. Affected versions include 11.5.0–11.5.9 and 12.1.0–12.1.3 across Linux, UNIX, and Windows platforms. It carries a CVSS v3.1 base score of 6.5 (Medium) (IBM Advisory, Red Hat CVE).

The root cause is classified as CWE-943 (Improper Neutralization of Special Elements in Data Query Logic). An authenticated attacker with network access can craft a SQL query invoking the JSON_Object scalar function in a way that triggers an unhandled exception within the Db2 engine, causing the server process to terminate abnormally. Exploitation requires only low privileges (a valid database user account) and no user interaction, with low attack complexity over a network vector. No public proof-of-concept code has been identified (IBM Advisory, Red Hat CVE).

Successful exploitation results in a complete loss of availability for the affected Db2 instance, as the server terminates abnormally. There is no impact on confidentiality or data integrity — the vulnerability is purely a denial-of-service condition. Any workloads, applications, or users dependent on the affected Db2 server would experience an outage until the service is restarted (IBM Advisory).

1. Obtain authenticated access: Acquire valid credentials for the target IBM Db2 instance (versions 11.5.0–11.5.9 or 12.1.0–12.1.3) through legitimate means, credential theft, or brute force.
2. Connect to the database: Establish a connection to the Db2 server using a standard client tool (e.g., db2 CLI, JDBC, ODBC) over the network.
3. Craft a malicious query: Construct a SQL query that invokes the JSON_Object scalar function with inputs designed to trigger the unhandled exception (specific payload details are not publicly documented).
4. Execute the query: Submit the crafted query to the Db2 server. The server processes the JSON_Object function call, encounters an unhandled exception, and terminates abnormally, causing a denial of service for all connected users and dependent applications (IBM Advisory).

• Logs: Unexpected Db2 engine crash entries or db2diag.log records showing unhandled exceptions or abnormal termination events correlated with JSON_Object function calls.
• Process: Sudden termination of the db2sysc or related Db2 engine processes without a planned shutdown.
• Logs: Database audit logs showing authenticated queries containing JSON_Object scalar function invocations immediately preceding server crashes.
• Network: Repeated connection attempts or reconnections from application servers following unexpected Db2 service outages.

IBM has released a patch addressing this vulnerability, available through the IBM support portal (node 7257681). Administrators should apply the fix immediately for all affected Db2 instances running versions 11.5.0–11.5.9 or 12.1.0–12.1.3. As interim mitigations, restrict database access to trusted users only, implement network segmentation to limit exposure of Db2 ports, and enable query logging to monitor for unusual use of the JSON_Object function (IBM Advisory).