CVE-2025-36071 Overview
CVE-2025-36071 is a denial of service vulnerability affecting IBM Db2 for Linux, UNIX and Windows, including DB2 Connect Server. The flaw exists in versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.2. A remote attacker can submit a specially crafted query that triggers improper release of memory resources, causing the database server to crash. The issue is tracked under CWE-772: Missing Release of Resource after Effective Lifetime. No authentication or user interaction is required to exploit the condition over the network.
Critical Impact
A remote, unauthenticated attacker can crash IBM Db2 database instances by sending crafted queries, disrupting availability of dependent applications and services.
Affected Products
- IBM Db2 for Linux, UNIX and Windows 11.5.0 through 11.5.9
- IBM Db2 for Linux, UNIX and Windows 12.1.0 through 12.1.2
- IBM DB2 Connect Server (same affected version ranges)
Discovery Timeline
- 2025-07-29 - CVE-2025-36071 published to the National Vulnerability Database
- 2025-08-07 - Last updated in NVD database
Technical Details for CVE-2025-36071
Vulnerability Analysis
The vulnerability is a denial of service condition rooted in improper memory resource management within the Db2 query processing path. When the database server handles a specially crafted query, it fails to release allocated memory resources correctly. Under certain conditions this leads to a crash of the Db2 server process, terminating active sessions and halting query execution.
The attack vector is network-based and requires no authentication or user interaction. Impact is confined to availability — confidentiality and integrity are not affected. Because Db2 typically backs business-critical applications, a process crash cascades into outages for any service relying on that database instance.
The weakness is classified as CWE-772 (Missing Release of Resource after Effective Lifetime). EPSS data places exploitation probability at 0.074%, indicating no observed in-the-wild exploitation at this time. No public proof-of-concept code has been published.
Root Cause
The Db2 engine fails to properly release memory resources allocated during processing of certain query structures. Repeated or single-shot crafted queries can drive the server into an unrecoverable state, terminating the database process.
Attack Vector
An attacker with network access to a Db2 listener submits a crafted SQL query through any client capable of reaching the database service. Because privileges required are listed as none in the CVSS vector, exposure depends on whether the listener is reachable from untrusted networks or compromised internal hosts.
No verified exploit code is publicly available. Refer to the IBM Support Page for vendor technical details.
Detection Methods for CVE-2025-36071
Indicators of Compromise
- Unexpected termination or restart of db2sysc processes on affected hosts
- Db2 diagnostic log (db2diag.log) entries showing abnormal memory release errors or trap files generated near the time of crashes
- Connection resets or query timeouts reported by application tiers connecting to Db2 instances
- Generation of FODC (First Occurrence Data Capture) directories under the Db2 diagnostic path coinciding with malformed queries
Detection Strategies
- Monitor Db2 service availability and process uptime to flag unexpected restarts of the database engine
- Inspect db2diag.log and trap files for crash signatures referencing memory management routines
- Correlate inbound SQL traffic with crash events to identify the source IP submitting crafted queries
- Enable database audit logging to record query patterns preceding service termination
Monitoring Recommendations
- Forward Db2 diagnostic logs and operating system process events to a centralized SIEM for correlation
- Alert on repeated Db2 instance crashes within short time windows from the same client source
- Track network connections to Db2 ports (default 50000/tcp) from non-application subnets
How to Mitigate CVE-2025-36071
Immediate Actions Required
- Apply the IBM-provided fix pack or special build referenced in the IBM Support Page for CVE-2025-36071
- Restrict network access to Db2 listener ports so only trusted application servers can reach the database
- Inventory all Db2 instances and confirm versions against the affected range (11.5.0–11.5.9, 12.1.0–12.1.2)
- Review and rotate any database credentials exposed to untrusted networks during the exposure window
Patch Information
IBM has published remediation guidance and fix availability on the IBM Support Page for CVE-2025-36071. Administrators should upgrade to the fixed version specified by IBM for their installed release line. Db2 12.1.x deployments should move beyond 12.1.2, and 11.5.x deployments should apply the corresponding fix pack released after 11.5.9.
Workarounds
- Place Db2 listeners behind network access control lists that permit connections only from authorized application servers
- Use database connection proxies or middleware that can rate-limit or inspect SQL before it reaches Db2
- Configure automated service recovery so crashed Db2 instances restart quickly while patching is scheduled
- Increase monitoring of Db2 diagnostic logs to detect exploitation attempts during the patch window
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
