CVE-2025-36424: 
IBM Db2 vulnerability analysis and mitigation

CVE-2025-36424 is a denial-of-service vulnerability in IBM Db2 for Linux, UNIX and Windows (including Db2 Connect Server) caused by improper neutralization of special elements in data query logic. It affects versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 on Linux, UNIX, and Windows platforms. The vulnerability was published on January 30, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (IBM Advisory, Red Hat CVE).

The root cause is classified as CWE-1284 (Improper Validation of Specified Quantity in Input), where special elements within data query logic are not properly neutralized, allowing a low-privileged authenticated user to trigger a denial-of-service condition. The attack vector is network-accessible with low attack complexity and requires only low privileges, with no user interaction needed. No public proof-of-concept code or detailed technical write-ups have been identified at this time (IBM Advisory, Red Hat CVE).

Successful exploitation results in a denial-of-service condition affecting the availability of the IBM Db2 database instance; there is no impact to confidentiality or integrity. An authenticated low-privileged user with network access to the Db2 server can disrupt database services, potentially affecting all applications and users dependent on the affected instance. Lateral movement or data exfiltration are not directly enabled by this vulnerability (IBM Advisory).

IBM has released patches addressing this vulnerability; users should upgrade IBM Db2 to a fixed version beyond 11.5.9 (for the 11.5.x line) or beyond 12.1.3 (for the 12.1.x line) as directed in the IBM support advisory. Organizations should consult the IBM support page for specific fix pack details and apply the recommended updates promptly. No configuration-based workarounds have been publicly documented (IBM Advisory).