CVE-2025-36008: IBM Db2 DOS Vulnerability

CVE-2025-36008 Overview

CVE-2025-36008 is a denial of service vulnerability in IBM Db2 for Linux, UNIX, and Windows, including Db2 Connect Server. The flaw affects versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3. An authenticated user can trigger improper allocation of resources, exhausting server capacity and disrupting database availability. The weakness is classified under [CWE-770: Allocation of Resources Without Limits or Throttling]. IBM published the advisory on the IBM Support Article.

Critical Impact
An authenticated remote attacker with low privileges can render IBM Db2 database services unavailable, disrupting dependent applications and business operations.

Affected Products

IBM Db2 for Linux, UNIX, and Windows 11.5.0 through 11.5.9
IBM Db2 for Linux, UNIX, and Windows 12.1.0 through 12.1.3
IBM Db2 Connect Server (bundled within affected Db2 releases)

Discovery Timeline

2025-11-07 - CVE-2025-36008 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-36008

Vulnerability Analysis

The vulnerability resides in how IBM Db2 allocates internal resources when processing requests from authenticated sessions. The database engine fails to enforce sufficient limits or throttling on resource consumption, allowing a low-privileged user to force excessive allocation. Sustained abuse drains available memory, threads, or handles until the Db2 instance stops serving legitimate queries.

Because the attack vector is network-based and requires only low privileges, any account with valid Db2 credentials becomes a potential trigger. There is no impact to confidentiality or integrity, but the availability impact is high. No public exploit or proof-of-concept has been published, and CISA has not added the flaw to the Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is improper allocation of resources [CWE-770]. Db2 does not adequately cap the volume of resources consumed by specific authenticated operations. Without throttling boundaries, a single session can request allocations that outpace release, leading to exhaustion of the shared resource pool used by all connections.

Attack Vector

An attacker authenticates to the Db2 instance over the network using valid credentials. The attacker then issues crafted operations that repeatedly consume server-side resources without releasing them. As the pool is depleted, new connections and in-flight transactions fail, producing a denial of service condition across the database instance and any dependent Db2 Connect Server workloads.

No verified proof-of-concept code is publicly available. Refer to the IBM Support Article for vendor-supplied technical detail.

Detection Methods for CVE-2025-36008

Indicators of Compromise

Db2 diagnostic log (db2diag.log) entries showing SQL1224N, memory allocation failures, or agent pool exhaustion.
Sudden growth in Db2 process memory (db2sysc) or thread counts without a corresponding change in legitimate workload.
Repeated authenticated sessions from a single principal issuing identical resource-heavy operations.

Detection Strategies

Correlate Db2 authentication events with subsequent resource-usage spikes to identify a single account driving exhaustion.
Monitor Db2 snapshot and MON_GET_* table functions for abnormal agent, memory pool, and connection counters.
Alert on failed connection attempts that coincide with high resource utilization on the Db2 host.

Monitoring Recommendations

Enable Db2 audit facility (db2audit) to capture authenticated session activity and resource-related errors.
Forward Db2 diagnostic and audit logs to a centralized analytics platform for anomaly detection and long-term retention.
Track host-level metrics (memory, CPU, file descriptors) on Db2 servers and page on sustained deviations from baseline.

How to Mitigate CVE-2025-36008

Immediate Actions Required

Apply the fixed Db2 release identified in the IBM Support Article as soon as change windows allow.
Inventory all Db2 11.5.x and 12.1.x deployments, including Db2 Connect Server instances, and prioritize internet-reachable systems.
Rotate and audit Db2 credentials, removing unused accounts and enforcing least privilege on the remaining principals.

Patch Information

IBM has published remediation guidance in the vendor advisory at the IBM Support Article. Administrators should upgrade affected Db2 11.5.0–11.5.9 and 12.1.0–12.1.3 instances to the fixed level specified by IBM for their release train. Db2 Connect Server components bundled with the affected releases must be updated alongside the database engine.

Workarounds

Restrict network access to Db2 listeners so that only trusted application hosts can reach the database port.
Enforce Db2 workload management (WLM) thresholds to cap per-connection memory, CPU time, and concurrent activities.
Require strong authentication and monitor for credential reuse to reduce the pool of accounts that could trigger the flaw.

bash

# Example Db2 WLM threshold limiting per-activity resource usage
db2 "CREATE THRESHOLD limit_activity_mem \
  FOR DATABASE ACTIVITIES \
  ENFORCEMENT DATABASE \
  WHEN ESTIMATEDSQLCOST > 100000 \
  STOP EXECUTION"

# Restrict inbound Db2 traffic (default port 50000) to trusted subnets
iptables -A INPUT -p tcp --dport 50000 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 50000 -j DROP