CVE-2025-36122 Details
Description
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow an authenticated user to cause a denial of service using a specially crafted SQL query due to improper allocation of system resources.
A denial-of-service vulnerability has been identified in IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 for Linux, UNIX, and Windows, including DB2 Connect Server. The issue allows an authenticated user to disrupt service by using a specially crafted SQL query, which takes advantage of improper resource allocation. This vulnerability arises when the 'stmtheap' setting is configured to automatic, enabling the exploitation through tailored SQL queries that exhaust system resources.
Users can upgrade to the special build #79671 or later for Db2 version 11.5.9, or to version 12.1.4. For version 11.5, the special build is available through Fix Central. After installing the special build, it is required to set 'DB2_STRICT_INSTANCE_MEMORY' to 'ON' to fully address the vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.ibm.com/support/pages/node/7267642 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ibm db2 | >= 11.5.0, <= 11.5.9 >= 12.1.0, <= 12.1.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 1, 2026 | Initial Analysis | [email protected] |
| Apr 30, 2026 | New CVE Received | [email protected] |