CVE-2025-36442: IBM Db2 Denial of Service Vulnerability

CVE-2025-36442 Overview

CVE-2025-36442 is a denial of service vulnerability affecting IBM Db2 for Linux, UNIX, and Windows, including Db2 Connect Server. The flaw allows a remote, unauthenticated attacker to crash the database server using a specially crafted query targeting XML columns. Affected versions span Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3. The vulnerability is tracked under CWE-943, Improper Neutralization of Special Elements in Data Query Logic.

Critical Impact
A remote attacker can crash the Db2 server without authentication by submitting a malformed query against XML columns, disrupting database availability for all dependent applications.

Affected Products

IBM Db2 for Linux, UNIX and Windows versions 11.5.0 through 11.5.9
IBM Db2 for Linux, UNIX and Windows versions 12.1.0 through 12.1.3
IBM Db2 Connect Server (included with the above versions)

Discovery Timeline

2026-01-30 - CVE-2025-36442 published to NVD
2026-02-05 - Last updated in NVD database

Technical Details for CVE-2025-36442

Vulnerability Analysis

The vulnerability resides in how the Db2 database engine processes queries that reference XML columns. When the server receives a specially crafted query targeting these columns, internal processing fails in a manner that terminates the database process. Successful exploitation results in loss of availability for all clients connected to the affected instance.

The issue is reachable over the network and requires no authentication or user interaction. Because Db2 typically serves as a backend for business-critical applications, an unexpected crash propagates failures across dependent services, web applications, and batch workloads.

Root Cause

The flaw is categorized as [CWE-943], Improper Neutralization of Special Elements in Data Query Logic. The Db2 query processor does not adequately validate or sanitize specific structures within queries that operate on XML columns. Malformed input reaches a code path where the server cannot recover, resulting in a process crash rather than a clean error response.

Attack Vector

An attacker requires network reachability to the Db2 listener and the ability to submit a query that references an XML column. Depending on the deployment, this can occur through any application path that forwards user-controlled query fragments to the database, or through direct connections to exposed Db2 ports. The vulnerability affects availability only and does not expose data or allow code execution.

No public proof-of-concept code or exploit modules have been published for CVE-2025-36442. Refer to the IBM Security Advisory for vendor-supplied technical detail.

Detection Methods for CVE-2025-36442

Indicators of Compromise

Unexpected db2sysc process termination or repeated automatic instance restarts on affected Db2 hosts.
Diagnostic entries in db2diag.log referencing trap files, signal handlers, or XML parsing failures around the time of a connection from an unusual source.
Spikes in connection resets or query errors from applications that interact with tables containing XML columns.

Detection Strategies

Monitor Db2 instance availability and process uptime, alerting on unscheduled restarts of the database engine.
Inspect query audit logs for malformed or unusually structured queries directed at tables with XML columns.
Correlate database crashes with network telemetry to identify the originating client IP and session.

Monitoring Recommendations

Ingest db2diag.log and Db2 audit output into a centralized logging or SIEM platform for retention and search.
Enable Db2 audit policies covering EXECUTE events on schemas that contain XML columns.
Track baseline query patterns and alert on anomalies in query volume or error rates following a deployment of the patch or any configuration change.

How to Mitigate CVE-2025-36442

Immediate Actions Required

Apply the IBM-supplied fix referenced in the IBM Security Advisory for the relevant Db2 release stream.
Restrict network access to Db2 listener ports so only application servers and trusted administrative hosts can connect.
Review application code paths that forward user input into queries touching XML columns and add server-side validation.

Patch Information

IBM has published fixes for the affected releases. Administrators running Db2 11.5.0 through 11.5.9 or 12.1.0 through 12.1.3 should upgrade to the fixed fix pack identified in the IBM Security Advisory. Db2 Connect Server installations are remediated through the same Db2 fix packs.

Workarounds

Limit exposure of Db2 ports using firewall rules or network segmentation until the patch is applied.
Revoke unnecessary SELECT privileges on tables that contain XML columns from low-trust application roles.
Front the database with application-layer input validation that rejects unexpected XML query constructs.

bash

# Example: restrict Db2 listener access at the host firewall (Linux, iptables)
# Replace 10.0.0.0/24 with your trusted application subnet and 50000 with your Db2 SVCENAME port
iptables -A INPUT -p tcp --dport 50000 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 50000 -j DROP