IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow an authenticated user to cause a denial of service due to excessive use of a global variable.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00016.

Exploitation none

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
IBM Db2 for Linux, UNIX and Windows unaffected
Version Status Constraints
11.5.0 affected ≤ 11.5.9
12.1.0 affected ≤ 12.1.3

Configuration 1 [-]

OR cpe:2.3:a:ibm:db2:*:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:*:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:*:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:*:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:*:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:*:*:*:*:*:windows:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Ibm Subscribe
Db2 Subscribe
Advisories

No advisories yet.

Fixes

Solution

Customers running any vulnerable modpack level of an affected Program, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V11.5.9, V12.1.2 and V12.1.3. They can be applied to any affected level of the appropriate release to remediate this vulnerability.   ReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 V12.1   TBD   https://www.ibm.com/support/pages/db2-v1212-published-cumulative-special-build-downloads Special Build #71609 or later for V12.1.3 available at this link: https://www.ibm.com/support/pages/db2-v1213-published-cumulative-special-build-downloads

Workaround

No workaround given by the vendor.

References
Link Providers
https://www.ibm.com/support/pages/node/7257695 cve-icon cve-icon
History

Wed, 11 Feb 2026 21:00:00 +0000

Type Values Removed Values Added
Weaknesses NVD-CWE-Other
CPEs cpe:2.3:a:ibm:db2:*:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:*:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:*:*:*:*:*:windows:*:*

Wed, 04 Feb 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-1108
References

Wed, 04 Feb 2026 18:00:00 +0000

Type Values Removed Values Added
Description IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an unauthenticated user to cause a denial of service due to excessive use of a global variable. IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow an authenticated user to cause a denial of service due to excessive use of a global variable.
Weaknesses CWE-1284
References

Mon, 02 Feb 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 30 Jan 2026 22:00:00 +0000

Type Values Removed Values Added
Description IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow an unauthenticated user to cause a denial of service due to excessive use of a global variable. IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an unauthenticated user to cause a denial of service due to excessive use of a global variable.

Fri, 30 Jan 2026 21:45:00 +0000

Type Values Removed Values Added
Description IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow an unauthenticated user to cause a denial of service due to excessive use of a global variable.
Title IBM Db2 Denial of Service
First Time appeared Ibm
Ibm db2
Weaknesses CWE-1108
CPEs cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:zos:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:zos:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:zos:*:*
cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:zos:*:*
Vendors & Products Ibm
Ibm db2
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-02-04T17:28:55.732Z

Reserved: 2025-04-15T21:16:05.533Z

Link: CVE-2025-36009

cve-icon Vulnrichment

Updated: 2026-02-02T16:25:21.544Z

cve-icon NVD

Status : Analyzed

Published: 2026-01-30T22:15:53.200

Modified: 2026-02-11T20:57:37.413

Link: CVE-2025-36009

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses