CVE-2025-36247: IBM Db2 XXE Vulnerability

CVE-2025-36247 Overview

CVE-2025-36247 is an XML External Entity (XXE) injection vulnerability affecting IBM Db2 for Linux, UNIX and Windows, including Db2 Connect Server. The flaw exists in how the database server processes XML data submitted by remote clients. A remote, unauthenticated attacker can exploit this issue to expose sensitive information or exhaust memory resources on the host system. Affected releases include Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3. The vulnerability is tracked under CWE-611 (Improper Restriction of XML External Entity Reference).

Critical Impact
Remote attackers without authentication can read sensitive files from the database server or trigger resource exhaustion, impacting confidentiality and availability of Db2 deployments.

Affected Products

IBM Db2 for Linux, UNIX and Windows versions 11.5.0 through 11.5.9
IBM Db2 for Linux, UNIX and Windows versions 12.1.0 through 12.1.3
IBM Db2 Connect Server (included in the above release ranges)

Discovery Timeline

2026-02-17 - CVE-2025-36247 published to NVD
2026-02-18 - Last updated in NVD database

Technical Details for CVE-2025-36247

Vulnerability Analysis

The vulnerability stems from insecure XML parsing within IBM Db2's XML processing routines. When Db2 ingests XML documents from a client, the parser resolves external entity references defined inside Document Type Definitions (DTDs). An attacker can craft an XML document that declares external entities pointing to local files or internal network resources. Db2 dereferences those entities during parsing and embeds the retrieved data in query results, error messages, or internal processing.

The scope of impact spans confidentiality and availability. Attackers can retrieve files readable by the Db2 service account, including configuration files containing credentials. They can also point entities at large or recursive resources to consume memory and degrade service performance. The network attack vector and lack of authentication requirements make this issue exploitable directly against exposed Db2 listeners.

Root Cause

The root cause is the failure to disable external entity and DTD processing in the XML parser used by Db2's XML data handlers. The parser honors SYSTEM and PUBLIC identifiers within <!DOCTYPE> declarations without restricting access to the local filesystem or outbound network calls. This matches the CWE-611 pattern of improper restriction of XML external entity references.

Attack Vector

Exploitation requires the attacker to submit malicious XML content to a Db2 instance that accepts XML input. This includes SQL statements that operate on XML data types, stored procedures that parse XML payloads, and Db2 Connect Server interfaces that proxy XML traffic. An attacker constructs an XML payload containing an external entity declaration that references a local file such as /etc/passwd or a Db2 configuration file. When Db2 parses the document, the entity is resolved and its content is returned through query output or surfaced in error responses. A variation of the attack uses recursive or oversized entities to trigger memory consumption and partial denial of service.

No public proof-of-concept is currently available for this CVE, and no exploitation in the wild has been reported.

Detection Methods for CVE-2025-36247

Indicators of Compromise

XML payloads sent to Db2 listeners containing <!DOCTYPE> declarations with SYSTEM or PUBLIC external entity references.
Unexpected outbound network connections originating from the Db2 service account to external hosts during query processing.
Db2 diagnostic logs (db2diag.log) showing parser errors referencing entity expansion failures or file access attempts.
Sudden spikes in memory consumption by db2sysc processes coinciding with XML-bearing client requests.

Detection Strategies

Inspect application-layer traffic to Db2 ports (default 50000/50001) for XML documents containing inline DTDs or external entity declarations.
Correlate Db2 audit logs with process telemetry to identify XML parsing operations that trigger filesystem reads outside of normal database paths.
Enable Db2 audit facility (db2audit) for the EXECUTE and OBJMAINT categories to capture XML-related statement execution.

Monitoring Recommendations

Forward Db2 db2diag.log and audit records to a centralized analytics platform and alert on entity-expansion errors.
Monitor file access events on the Db2 host for reads of sensitive configuration files (db2nodes.cfg, .profile, instance keystore files) by the Db2 instance owner.
Track outbound DNS and HTTP traffic from Db2 hosts to identify out-of-band XXE exfiltration patterns.

How to Mitigate CVE-2025-36247

Immediate Actions Required

Apply the fixed Db2 release identified in the IBM security bulletin to all instances running affected versions.
Restrict network access to Db2 listeners so that only trusted application servers can reach the database ports.
Review application code paths that accept XML input and validate whether DTD processing is required for business logic.

Patch Information

IBM has published remediation guidance and fixed levels in the IBM Support advisory for CVE-2025-36247. Administrators should upgrade Db2 11.5.x and Db2 12.1.x deployments to the fix pack identified in that advisory and restart the instance after applying the update.

Workarounds

Disable or strictly limit XML parsing in application layers that interact with Db2 until patches are deployed.
Place a database firewall or proxy in front of Db2 that strips <!DOCTYPE> declarations from inbound XML payloads.
Run Db2 under a service account with minimum filesystem privileges to reduce the value of any data exposed through XXE.

bash

# Configuration example: verify installed Db2 level and apply fix pack
db2level
# Expected output should reflect a patched version per IBM advisory 7259961
# Apply fix pack (example syntax; replace path with downloaded image)
./installFixPack -b /opt/ibm/db2/V11.5 -p /opt/ibm/db2/V11.5_fixpack -t /tmp/installFP.trc -l /tmp/installFP.log