CVE-2025-36247: IBM Db2 XXE Injection Vulnerability

CVE-2025-36247 Overview

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 contain an XML External Entity (XXE) injection vulnerability when processing XML data. This vulnerability allows a remote attacker to exploit improper XML parsing to expose sensitive information or consume memory resources, potentially leading to information disclosure and denial of service conditions.

Critical Impact

Remote attackers can exploit this XXE vulnerability to exfiltrate sensitive data from IBM Db2 database servers or cause memory exhaustion, impacting data confidentiality and system availability.

Affected Products

• IBM Db2 for Linux 11.5.0 - 11.5.9
• IBM Db2 for UNIX 11.5.0 - 11.5.9
• IBM Db2 for Windows 11.5.0 - 11.5.9
• IBM Db2 for Linux 12.1.0 - 12.1.3
• IBM Db2 for UNIX 12.1.0 - 12.1.3
• IBM Db2 for Windows 12.1.0 - 12.1.3
• IBM Db2 Connect Server (affected versions)

Discovery Timeline

• 2026-02-17 - CVE-2025-36247 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2025-36247

Vulnerability Analysis

This vulnerability is classified as CWE-611 (Improper Restriction of XML External Entity Reference). The XXE vulnerability in IBM Db2 arises from the application's failure to properly configure XML parsers to disable external entity processing. When the database server processes user-supplied XML data, it does not adequately restrict the resolution of external entity references.

The attack can be executed remotely over the network without requiring authentication or user interaction. An attacker can craft malicious XML payloads containing external entity declarations that, when processed by the vulnerable Db2 server, can be used to read arbitrary files from the server, perform server-side request forgery (SSRF), or cause denial of service through memory resource exhaustion.

Root Cause

The root cause of CVE-2025-36247 lies in the improper configuration of XML parsers within IBM Db2's XML processing components. When XML data is submitted to the database for processing, the XML parser does not disable external entity resolution by default. This allows attackers to include DOCTYPE declarations with external entity references that point to local files, internal network resources, or specially crafted payloads designed to exhaust system memory.

The vulnerable XML parsing affects multiple entry points where XML data can be submitted to the Db2 server, including but not limited to XML data type operations, stored procedures that process XML, and administrative interfaces that accept XML input.

Attack Vector

The attack vector for this vulnerability is network-based. An attacker can exploit this vulnerability by sending specially crafted XML data to the IBM Db2 server. The malicious XML document typically contains an external entity declaration that references sensitive local files (such as /etc/passwd on Linux/UNIX systems or configuration files on Windows) or causes recursive entity expansion to exhaust memory resources.

The attack does not require authentication to the database server when exposed interfaces accept XML input from unauthenticated sources. The exploitation complexity is low, making this vulnerability particularly concerning for organizations with internet-facing Db2 deployments.

Since no verified code examples are available for this vulnerability, readers should refer to the IBM Support Page for detailed technical information and mitigation guidance.

Detection Methods for CVE-2025-36247

Indicators of Compromise

• Unusual XML parsing errors in Db2 server logs containing references to external DTDs or entities
• Unexpected file read operations from the Db2 process accessing sensitive system files
• Abnormal outbound network connections from the database server to unknown external hosts
• Memory consumption spikes in Db2 processes during XML processing operations
• Log entries showing DOCTYPE declarations with ENTITY keywords in submitted XML data

Detection Strategies

• Monitor Db2 server logs for XML parsing errors that include external entity reference failures or timeouts
• Implement network detection rules to identify XML payloads containing DOCTYPE and ENTITY declarations
• Deploy application-layer firewalls to inspect and filter XML traffic destined for Db2 servers
• Use SentinelOne's behavioral AI to detect anomalous file access patterns from database processes

Monitoring Recommendations

• Enable verbose logging for XML operations in IBM Db2 to capture detailed parsing events
• Configure network monitoring to alert on unusual outbound connections from database servers
• Implement file integrity monitoring for sensitive system files that may be targeted through XXE attacks
• Monitor memory utilization trends on Db2 servers to detect resource exhaustion attempts

How to Mitigate CVE-2025-36247

Immediate Actions Required

• Review the IBM Support Page for specific patch information and apply available updates
• Identify all IBM Db2 instances running affected versions (11.5.0-11.5.9 and 12.1.0-12.1.3)
• Restrict network access to Db2 servers using firewall rules to limit exposure
• Implement input validation for XML data submitted to Db2 applications
• Consider deploying web application firewalls to filter malicious XML payloads

Patch Information

IBM has released a security advisory addressing this vulnerability. Organizations should immediately consult the IBM Support Page for the latest patch information and apply security updates to all affected IBM Db2 installations. It is critical to update both primary database servers and any Db2 Connect Server instances within the affected version ranges.

Workarounds

• Configure XML parsers to explicitly disable external entity processing where possible
• Implement network segmentation to isolate Db2 servers from untrusted networks
• Deploy application-level input validation to sanitize XML data before processing
• Use XML schemas to validate input and reject documents containing external entity references
• Monitor and limit memory resources available to XML processing operations to mitigate DoS impact

# Example: Network segmentation to restrict Db2 access
# Limit inbound connections to Db2 default port from trusted networks only
iptables -A INPUT -p tcp --dport 50000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 50000 -j DROP

# Enable detailed logging for XML operations (consult IBM documentation)
# db2 update dbm cfg using DIAGLEVEL 4