CVE-2025-36387: 
IBM Db2 vulnerability analysis and mitigation

CVE-2025-36387 is a denial-of-service vulnerability in IBM Db2 for Linux, UNIX, and Windows (including DB2 Connect Server) affecting versions 11.5.0 through 11.5.9. An authenticated user can crash the database by submitting a specially crafted query, exploiting improper resource allocation without limits or throttling. The vulnerability was published on January 30, 2026, with a patch made available by IBM. It carries a CVSS v3.1 base score of 6.5 (Medium) (IBM Advisory, Red Hat CVE).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling), where the Db2 query processing engine fails to enforce adequate resource consumption limits on specially crafted queries. An authenticated attacker with network access and low-level database privileges can submit a malicious query that causes excessive resource allocation, ultimately crashing the database service. No user interaction is required beyond submitting the crafted query. No public technical write-up or proof-of-concept code has been identified at this time (IBM Advisory, Red Hat CVE).

Successful exploitation results in a complete loss of availability for the IBM Db2 database service, disrupting all applications and services that depend on it. There is no impact on confidentiality or integrity — the attack is limited to causing a denial-of-service condition. The outage affects all users and workloads relying on the targeted Db2 instance, potentially causing significant business disruption in environments where Db2 is a critical data tier (IBM Advisory).

IBM has released a patch addressing this vulnerability; administrators should apply the fix documented in IBM support page node 7257690 for all affected Db2 11.5.x installations. As interim mitigations, restrict database access to trusted and necessary users only, implement query timeout thresholds and resource governor limits at the database level, and monitor for resource-intensive or anomalous query patterns. Upgrading to a patched version is the recommended long-term remediation (IBM Advisory).