CVE-2025-36006: IBM Db2 Denial of Service Vulnerability

CVE-2025-36006 Overview

CVE-2025-36006 is a denial-of-service vulnerability affecting IBM Db2 for Linux, UNIX, and Windows, including Db2 Connect Server. The flaw stems from the improper release of resources after use, classified as [CWE-404]. An authenticated user with low privileges can trigger the condition remotely over the network, exhausting server-side resources and disrupting database availability.

The issue impacts a wide range of long-supported Db2 releases spanning versions 10.5 through 12.1. Because Db2 typically backs mission-critical transactional workloads, service disruption can cascade to dependent applications and business processes.

Critical Impact
An authenticated attacker can remotely trigger resource exhaustion in Db2, causing denial of service across production database instances.

Affected Products

IBM Db2 for Linux, UNIX, and Windows 10.5.0 through 10.5.11
IBM Db2 for Linux, UNIX, and Windows 11.1.0 through 11.1.4.7
IBM Db2 for Linux, UNIX, and Windows 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 (includes Db2 Connect Server)

Discovery Timeline

2025-11-07 - CVE-2025-36006 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-36006

Vulnerability Analysis

CVE-2025-36006 is a denial-of-service condition rooted in improper release of resources after use [CWE-404]. When specific operations complete, the affected Db2 code paths fail to free allocated resources such as memory, handles, or connection state. Repeated invocation by an authenticated user causes progressive exhaustion of these resources.

Once exhausted, the Db2 instance cannot service new requests and may terminate connections or crash. Recovery typically requires restarting the database manager, which interrupts availability for all connected clients. The flaw affects confidentiality and integrity minimally but has a direct high impact on availability.

Because exploitation requires only low privileges and no user interaction, any account with basic connectivity to the Db2 instance can trigger the condition. In shared or multi-tenant deployments this significantly widens the potential attacker pool.

Root Cause

The underlying defect is a missing or incomplete resource cleanup path in Db2 request handling. Resources allocated during processing are not consistently released when execution finishes or errors out, producing a leak that accumulates with each request.

Attack Vector

Exploitation occurs over the network against the Db2 listener. An attacker authenticates using any valid Db2 credential, then repeatedly issues the affected operation to drain server resources until the database service becomes unresponsive. No client-side interaction is needed.

No public exploit or proof-of-concept has been published for CVE-2025-36006 at the time of writing. Refer to the IBM Support advisory for vendor technical details.

Detection Methods for CVE-2025-36006

Indicators of Compromise

Sustained growth in Db2 process memory (db2sysc) or file descriptor usage without a corresponding increase in legitimate workload.
Repeated SQL1224N or connection refusal errors returned to clients as the instance approaches resource limits.
Unexpected restarts of the Db2 database manager or crash entries in the db2diag.log file.

Detection Strategies

Baseline resource consumption per authenticated Db2 user and alert on anomalous, sustained request rates from a single principal.
Correlate database error logs with connection telemetry to identify low-privileged accounts issuing repetitive operations before availability degradation.
Monitor Db2 audit facility (db2audit) events for unusual query patterns originating from accounts that typically issue low volumes of traffic.

Monitoring Recommendations

Enable and forward db2diag.log, db2audit records, and OS-level resource metrics to a centralized SIEM for correlation.
Track memory, thread, and handle counts for the db2sysc process with alerting thresholds tuned to normal operating ranges.
Review authentication logs for newly created or rarely used accounts that begin generating high volumes of database activity.

How to Mitigate CVE-2025-36006

Immediate Actions Required

Inventory all Db2 for LUW instances and identify versions in the vulnerable ranges (10.5.0–10.5.11, 11.1.0–11.1.4.7, 11.5.0–11.5.9, 12.1.0–12.1.3).
Apply the fix pack referenced in the IBM Support advisory as soon as maintenance windows allow.
Restrict network exposure of the Db2 listener to trusted application hosts and administrative subnets only.
Review and prune unused or over-privileged Db2 accounts to reduce the pool of authenticated principals capable of triggering the flaw.

Patch Information

IBM has released fixes documented on the IBM Support Page for Node 7250479. Administrators should apply the corresponding fix pack for their major release line (10.5, 11.1, 11.5, or 12.1) and validate the upgrade against staging environments before deploying to production.

Workarounds

Enforce strict authentication controls and rotate Db2 credentials to reduce the risk of unauthorized authenticated access.
Apply connection throttling or rate limits at the network or application tier to bound the request volume any single user can generate.
Configure Db2 resource limits (DBM CFG and workload management thresholds) to constrain per-user resource consumption where feasible.
Increase monitoring cadence on Db2 host memory and process health so operators can restart the instance before a full outage occurs.

bash

# Example: query Db2 fix pack level to identify vulnerable installations
db2level

# Example: enable audit facility to capture per-user activity
db2audit configure scope context status both
db2audit start