CVE-2025-36387: IBM Db2 DoS Vulnerability

CVE-2025-36387 Overview

CVE-2025-36387 is a denial of service vulnerability affecting IBM Db2 for Linux, UNIX, and Windows, including DB2 Connect Server, versions 11.5.0 through 11.5.9. An authenticated user can send a specially crafted query that causes the database service to become unresponsive. The flaw is tracked under [CWE-770: Allocation of Resources Without Limits or Throttling]. IBM published a corresponding advisory through its support portal.

Critical Impact
An authenticated attacker can disrupt database availability across IBM Db2 deployments, impacting downstream applications that depend on the database service.

Affected Products

IBM Db2 for Linux 11.5.0 through 11.5.9
IBM Db2 for UNIX 11.5.0 through 11.5.9
IBM Db2 for Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9

Discovery Timeline

2026-01-30 - CVE-2025-36387 published to NVD
2026-02-05 - Last updated in NVD database

Technical Details for CVE-2025-36387

Vulnerability Analysis

The vulnerability allows an authenticated user to trigger a denial of service condition by submitting a specially crafted query to a Db2 instance. The query causes the database engine to consume resources without bounds, leading to service unavailability. The issue affects confidentiality and integrity minimally but produces high impact on availability. Because exploitation only requires low-privileged authenticated access over the network, any legitimate database account can become a vector for disruption.

Db2 is widely deployed as a core transactional backend for enterprise applications. A successful denial of service against the database tier directly degrades or halts dependent business systems, including DB2 Connect Server gateways.

Root Cause

The root cause is improper resource allocation handling within the query processor, classified as [CWE-770]. When the database receives the crafted query, it fails to throttle or limit the resources consumed during parsing or execution. This causes excessive memory, CPU, or thread consumption that the engine cannot recover from gracefully.

Attack Vector

The attack vector is network-based and requires authentication. An attacker with valid Db2 credentials, including low-privileged accounts, connects to the database instance and submits the crafted query through a standard client interface. No user interaction is required, and the attack complexity is low. Refer to the IBM Support advisory for vendor-specific technical context.

No verified public proof-of-concept code is available, so the vulnerability is described in prose without synthetic exploitation examples.

Detection Methods for CVE-2025-36387

Indicators of Compromise

Sudden unresponsiveness of the Db2 instance accompanied by abnormal CPU, memory, or thread utilization on the database host.
Db2 diagnostic logs (db2diag.log) containing repeated errors, memory allocation failures, or agent crashes correlated to a specific session.
Failed transactions or connection timeouts reported by dependent applications without a corresponding infrastructure outage.

Detection Strategies

Monitor db2diag.log and Db2 audit facility events for anomalous query patterns originating from low-privileged accounts.
Correlate authenticated session activity with sharp spikes in database server resource consumption.
Enable Db2 workload management event monitors to flag queries that exceed CPU, memory, or execution time thresholds.

Monitoring Recommendations

Forward Db2 audit and diagnostic logs to a centralized log platform for query-level analysis and historical baselining.
Alert on repeated abnormal terminations of Db2 agents or EDU threads tied to a single authenticated user.
Track availability metrics on the database service and trigger alerts when responsiveness degrades outside of maintenance windows.

How to Mitigate CVE-2025-36387

Immediate Actions Required

Apply the fix referenced in the IBM Support advisory for Db2 11.5.0 through 11.5.9.
Audit Db2 user accounts and revoke unused or unnecessary credentials that could be leveraged to submit crafted queries.
Restrict network access to Db2 listener ports so that only trusted application hosts can establish authenticated sessions.

Patch Information

IBM has published remediation guidance for CVE-2025-36387 on the IBM Support Page. Administrators should review the advisory for the specific fix pack or interim fix applicable to their Db2 11.5.x release and plan an upgrade according to IBM's instructions.

Workarounds

Enforce Db2 workload management (WLM) thresholds to cap CPU time, memory, and execution duration per query, reducing the blast radius of a malicious query.
Limit CONNECT and EXECUTE privileges to the minimum required for each application account until the patch is deployed.
Place Db2 instances behind network segmentation that restricts client connectivity to known application servers.

bash

# Example: enforce a query CPU time threshold in Db2 WLM
db2 "CREATE THRESHOLD LIMIT_CPU FOR DATABASE ACTIVITIES \
  ENFORCEMENT DATABASE \
  WHEN CPUTIME > 30 SECONDS CHECKING EVERY 5 SECONDS \
  STOP EXECUTION"
db2 "ALTER THRESHOLD LIMIT_CPU ENABLE"