CVE-2025-36070 Overview
CVE-2025-36070 is a denial of service vulnerability affecting IBM Db2 for Linux, UNIX and Windows, including Db2 Connect Server. The flaw exists in versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3. A trap condition occurs when a user selects data from certain types of tables, causing the database engine to terminate.
The issue is categorized under [CWE-770] (Allocation of Resources Without Limits or Throttling). An unauthenticated network attacker with the ability to issue SQL queries can trigger the condition. Successful exploitation impacts service availability without affecting confidentiality or integrity.
Critical Impact
Remote attackers can crash the Db2 database engine through specially crafted SELECT statements against vulnerable table types, disrupting business operations dependent on Db2 services.
Affected Products
- IBM Db2 for Linux, UNIX and Windows 11.5.0 through 11.5.9
- IBM Db2 for Linux, UNIX and Windows 12.1.0 through 12.1.3
- IBM Db2 Connect Server (same affected version ranges)
Discovery Timeline
- 2026-01-30 - CVE-2025-36070 published to NVD
- 2026-02-05 - Last updated in NVD database
Technical Details for CVE-2025-36070
Vulnerability Analysis
The vulnerability resides in the Db2 query processing engine. When a client issues a SELECT statement against specific table types, the engine encounters an unhandled condition and traps. A trap in Db2 terminology denotes an internal exception that aborts the affected database process or agent.
Because the trap can be reached through standard SQL query interfaces, no privileged access or local presence is required. The result is a denial of service against the database instance, which can cascade to dependent applications and services. The vulnerability impacts availability only — data confidentiality and integrity remain intact.
Root Cause
The root cause maps to [CWE-770], reflecting improper handling of resource conditions during query execution against certain table structures. The Db2 engine fails to validate or constrain a condition encountered while processing rows from these table types, leading to an unrecoverable trap. IBM has not published low-level technical details in the public advisory.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An attacker reaching the Db2 listener port — typically TCP 50000 or a configured equivalent — can submit a SELECT query crafted to target a vulnerable table type. In deployments where Db2 is exposed to broader networks or accessible to low-trust application tiers, the attack surface is significant.
No verified exploit code or public proof-of-concept is currently available. Refer to the IBM Support advisory for vendor guidance on affected components and behavior.
Detection Methods for CVE-2025-36070
Indicators of Compromise
- Unexpected Db2 instance crashes or agent traps logged in db2diag.log with FODC (First Occurrence Data Capture) directories generated near the time of query execution.
- Repeated client disconnections coinciding with SELECT statements against specific tables.
- Spikes in connection retries from application tiers as Db2 services restart following a trap.
Detection Strategies
- Monitor db2diag.log for trap entries and correlate them with the SQL statements active in MON_GET_ACTIVITY or MON_GET_PKG_CACHE_STMT at the time of failure.
- Enable Db2 audit logging on EXECUTE events to capture SQL statements preceding instance failures.
- Compare the running Db2 version against the fixed releases listed in the IBM advisory to flag exposed hosts.
Monitoring Recommendations
- Alert on creation of new FODC trap directories under the Db2 diagnostic path.
- Track Db2 instance restart events and agent termination rates as availability indicators.
- Forward database logs and host telemetry to a centralized data lake for cross-correlation with network query sources.
How to Mitigate CVE-2025-36070
Immediate Actions Required
- Apply the IBM-provided fix pack as documented in the IBM Support advisory for your specific Db2 version branch.
- Restrict network access to Db2 listener ports so only trusted application servers can connect.
- Review application code paths to ensure unauthenticated users cannot inject arbitrary SELECT statements against the database.
Patch Information
IBM has published remediation details for CVE-2025-36070 on the IBM Support Page. Customers running Db2 versions 11.5.0 through 11.5.9 or 12.1.0 through 12.1.3 should upgrade to the fixed level identified in that advisory. Db2 Connect Server deployments share the same code base and require the same remediation.
Workarounds
- Limit direct database query access to trusted users and middleware until patching is complete.
- Enforce network segmentation and firewall rules to block Db2 ports from untrusted networks.
- Use connection pooling layers that validate or constrain ad hoc SQL submissions from end users.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
