CVE-2025-36428 Overview
CVE-2025-36428 affects IBM Db2 for Linux, UNIX and Windows, including Db2 Connect Server. The flaw lets an authenticated user trigger a denial of service through improper neutralization of special elements in data query logic when the RPSCAN feature is enabled. The issue maps to [CWE-1284] (Improper Validation of Specified Quantity in Input). Affected releases include Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3. IBM published advisory details on its support portal.
Critical Impact
An authenticated attacker can crash or render Db2 instances unavailable by submitting crafted queries that exercise the RPSCAN query logic, disrupting database-dependent applications.
Affected Products
- IBM Db2 for Linux, UNIX and Windows 11.5.0 through 11.5.9
- IBM Db2 for Linux, UNIX and Windows 12.1.0 through 12.1.3
- IBM Db2 Connect Server (matching releases)
Discovery Timeline
- 2026-01-30 - CVE-2025-36428 published to NVD
- 2026-02-05 - Last updated in NVD database
Technical Details for CVE-2025-36428
Vulnerability Analysis
The vulnerability resides in Db2's data query logic when the RPSCAN feature is enabled. RPSCAN is an internal scan optimization used during query evaluation. The engine fails to properly neutralize special elements within the input it processes during this scan path. An authenticated user submitting a crafted query can drive the engine into an error state that terminates processing and exhausts availability for legitimate workloads.
The attack requires network access to the database listener and valid credentials with the ability to submit queries. Confidentiality and integrity are not affected, but availability is fully impacted because the database service becomes unresponsive or the affected instance terminates abnormally.
Root Cause
The root cause is improper validation and neutralization of special elements supplied to the RPSCAN query path, classified under [CWE-1284]. When the input quantity or composition deviates from the engine's assumptions, the scan logic does not safely reject the input. Instead it propagates the malformed state through query execution, producing a fault that takes down the serving process.
Attack Vector
An authenticated user submits a specially crafted SQL statement designed to invoke the RPSCAN code path. The vector is remote over the standard Db2 network protocol. Attack complexity is high because the attacker must shape input to satisfy the conditions that trigger the unsafe path, and the RPSCAN feature must be enabled in the target configuration. No user interaction is required beyond the attacker's own session.
No public proof-of-concept exploit code is available for CVE-2025-36428. Refer to the IBM Support Page for vendor-provided technical context.
Detection Methods for CVE-2025-36428
Indicators of Compromise
- Repeated db2sysc process crashes or unexpected instance restarts correlated with specific authenticated sessions.
- Db2 diagnostic log (db2diag.log) entries showing query failures or trap files generated during RPSCAN execution.
- Sudden spikes in SQL1224N or connection-loss errors reported by clients against affected instances.
Detection Strategies
- Audit Db2 query history through SYSIBMADM.SNAPSTMT or the event monitor for anomalous statements issued before instance termination.
- Correlate authentication events with subsequent service restarts to attribute crashes to specific user accounts.
- Monitor for the creation of new trap (.trap.txt) and dump files in the Db2 diagnostic path.
Monitoring Recommendations
- Enable Db2 audit policies on EXECUTE and CONTEXT categories for sensitive databases to capture statement text.
- Forward db2diag.log and Db2 audit records to a centralized log platform for correlation against authentication telemetry.
- Alert on Db2 instance availability changes and abnormal process exits at the host level.
How to Mitigate CVE-2025-36428
Immediate Actions Required
- Apply the IBM-provided fix as documented in the IBM Support Page for CVE-2025-36428.
- Inventory Db2 instances and identify any running versions 11.5.0 through 11.5.9 or 12.1.0 through 12.1.3.
- Restrict database access to required service accounts and revoke unused query privileges to reduce the authenticated attack surface.
Patch Information
IBM has published remediation guidance on its support portal. Administrators should consult the IBM Support Page to obtain the appropriate fix pack or special build for the deployed Db2 version and platform (Linux, UNIX, or Windows).
Workarounds
- Disable the RPSCAN feature where business workloads permit, eliminating the vulnerable code path until the patch is applied.
- Limit network exposure of the Db2 listener through firewall rules so only application servers and administrative hosts can reach it.
- Enforce least privilege on database accounts to minimize the population of users capable of submitting arbitrary queries.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
