CVE-2025-36428: 
IBM Db2 vulnerability analysis and mitigation

CVE-2025-36428 is a denial-of-service vulnerability in IBM Db2 for Linux, UNIX, and Windows (including Db2 Connect Server) caused by improper neutralization of special elements in data query logic when the RPSCAN feature is enabled. It affects versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3. The vulnerability was published on January 30, 2026, and a patch is available from IBM. It carries a CVSS v3.1 base score of 5.3 (Medium) (IBM Advisory, Red Hat CVE).

The root cause is classified as CWE-1284 (Improper Validation of Specified Quantity in Input), where the RPSCAN feature in IBM Db2 fails to properly neutralize special elements within data query logic. An authenticated, low-privileged attacker can send specially crafted queries over the network to trigger this flaw, causing the database process to crash. Exploitation requires the RPSCAN feature to be enabled and involves high attack complexity, limiting opportunistic abuse but remaining feasible for determined insiders or attackers with database credentials (IBM Advisory, Red Hat CVE).

Successful exploitation results in a denial-of-service condition that crashes the IBM Db2 database instance, disrupting availability for all users and applications dependent on that instance. There is no impact on confidentiality or data integrity. The scope is limited to the affected Db2 instance, with no evidence of lateral movement potential or data exposure risk (IBM Advisory).

IBM has released patches for affected versions; administrators should apply the fixes detailed in the IBM support page for Db2 11.5.0–11.5.9 and 12.1.0–12.1.3. As an interim workaround, disabling the RPSCAN feature will eliminate the attack surface until patching can be completed. Additionally, restricting database access to trusted users and networks reduces exposure, and monitoring for unusual query patterns or unexpected database crashes can help detect exploitation attempts (IBM Advisory).