CVE-2025-36428: IBM Db2 Denial of Service Vulnerability

CVE-2025-36428 Overview

CVE-2025-36428 is a denial of service vulnerability affecting IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server). The vulnerability exists due to improper neutralization of special elements in data query logic when the RPSCAN feature is enabled. An authenticated user can exploit this flaw to cause service disruption, potentially impacting database availability for enterprise applications relying on Db2.

Critical Impact

Authenticated attackers can trigger a denial of service condition in IBM Db2 databases when the RPSCAN feature is enabled, potentially disrupting critical business operations and database availability.

Affected Products

• IBM Db2 for Linux 11.5.0 - 11.5.9
• IBM Db2 for UNIX 11.5.0 - 11.5.9
• IBM Db2 for Windows 11.5.0 - 11.5.9
• IBM Db2 for Linux 12.1.0 - 12.1.3
• IBM Db2 for UNIX 12.1.0 - 12.1.3
• IBM Db2 for Windows 12.1.0 - 12.1.3
• IBM Db2 Connect Server (affected versions)

Discovery Timeline

• 2026-01-30 - CVE-2025-36428 published to NVD
• 2026-02-05 - Last updated in NVD database

Technical Details for CVE-2025-36428

Vulnerability Analysis

This vulnerability is classified under CWE-1284 (Improper Validation of Specified Quantity in Input). The flaw resides in how IBM Db2 processes data query logic when the RPSCAN (Row and Page Scan) feature is active. When enabled, RPSCAN optimizes query processing by scanning rows and pages more efficiently, but the implementation fails to properly neutralize special elements within query parameters.

The attack requires network access and authentication to the Db2 instance, but once an attacker has valid credentials, they can craft malicious queries that exploit the improper input handling. The vulnerability specifically affects the availability of the system without impacting confidentiality or integrity of the data.

Root Cause

The root cause stems from improper neutralization of special elements in data query logic. When the RPSCAN feature processes certain query constructs, it fails to adequately validate and sanitize input parameters. This allows specially crafted queries to trigger resource exhaustion or processing errors that lead to denial of service conditions.

The vulnerability exists because the RPSCAN optimization pathway does not implement the same level of input validation as standard query processing paths, creating an exploitable gap when this feature is enabled.

Attack Vector

The attack vector is network-based, requiring the attacker to have authenticated access to the IBM Db2 database. The attack complexity is considered high because successful exploitation depends on the RPSCAN feature being enabled, which is not the default configuration in all deployments.

An authenticated user can submit specially crafted queries that contain malicious special elements designed to exploit the improper neutralization in the RPSCAN processing logic. When these queries are processed, they can cause the database service to become unresponsive or crash, resulting in denial of service.

The vulnerability does not require user interaction beyond the initial authenticated connection, and the scope is unchanged, meaning the impact is limited to the vulnerable Db2 component itself.

Detection Methods for CVE-2025-36428

Indicators of Compromise

• Unexpected database service crashes or restarts when processing specific queries
• Abnormal resource consumption (CPU, memory) during query execution with RPSCAN enabled
• Error logs showing query processing failures related to special character handling
• Repeated authentication attempts followed by unusual query patterns from specific users

Detection Strategies

• Monitor Db2 diagnostic logs (db2diag.log) for unusual query processing errors or crashes
• Implement database activity monitoring to detect anomalous query patterns from authenticated users
• Configure alerts for unexpected Db2 service interruptions or restarts
• Review audit logs for queries containing unusual special characters when RPSCAN is active

Monitoring Recommendations

• Enable comprehensive query logging to capture potential exploitation attempts
• Deploy SentinelOne Singularity platform to monitor for process anomalies and service disruptions on Db2 hosts
• Establish baseline metrics for normal Db2 resource consumption and alert on deviations
• Implement real-time monitoring of the RPSCAN feature activity and related query processing

How to Mitigate CVE-2025-36428

Immediate Actions Required

• Verify if the RPSCAN feature is enabled in your IBM Db2 deployment and assess necessity
• Apply the latest security patches from IBM as soon as available
• Review and restrict database user privileges to minimize exposure
• Implement network segmentation to limit access to Db2 instances from untrusted networks

Patch Information

IBM has released a security advisory addressing this vulnerability. Administrators should consult the IBM Support Page for detailed patch information and upgrade instructions. The affected versions span IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 across Linux, UNIX, and Windows platforms.

Organizations should prioritize upgrading to the latest patched version of IBM Db2 that addresses this vulnerability. Follow IBM's standard upgrade procedures and ensure proper testing in non-production environments before applying patches to production systems.

Workarounds

• Disable the RPSCAN feature if it is not essential for your workload to eliminate the attack surface
• Implement strict access controls to limit authenticated users who can execute queries against affected Db2 instances
• Deploy additional query filtering or web application firewalls to sanitize potentially malicious input
• Consider isolating Db2 instances in network segments with restricted access until patches are applied

# Configuration example - Disable RPSCAN feature (consult IBM documentation)
# Connect to Db2 and update database configuration
db2 update db cfg for <database_name> using RPSCAN OFF
db2 terminate
# Verify the configuration change
db2 get db cfg for <database_name> | grep -i rpscan