IBM DB2/DB2 Connect Server up to 10.5.11/11.1.4.7/11.5.9/12.1.3 denial of service

Summaryinfo

A vulnerability categorized as problematic has been discovered in IBM DB2 and DB2 Connect Server up to 10.5.11/11.1.4.7/11.5.9/12.1.3. Impacted is an unknown function. Such manipulation leads to denial of service. This vulnerability is documented as CVE-2025-36006. The attack can be executed remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in IBM DB2 and DB2 Connect Server up to 10.5.11/11.1.4.7/11.5.9/12.1.3 and classified as problematic. Affected by this issue is an unknown functionality. The manipulation with an unknown input leads to a denial of service vulnerability. Using CWE to declare the problem leads to CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. Impacted is availability. CVE summarizes:

IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial due to the improper release of resources after use.

The advisory is shared for download at ibm.com. This vulnerability is handled as CVE-2025-36006 since 04/15/2025. The exploitation is known to be easy. The attack may be launched remotely. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1499.

The vulnerability scanner Nessus provides a plugin with the ID 276923 (IBM DB2 DoS (7250479) (Unix)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (276923). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Database Software

Vendor

• IBM

Name

• DB2
• DB2 Connect Server

Version

• 10.5.0
• 10.5.1
• 10.5.2
• 10.5.3
• 10.5.4
• 10.5.5
• 10.5.6
• 10.5.7
• 10.5.8
• 10.5.9
• 10.5.10
• 10.5.11
• 11.1.4.0
• 11.1.4.1
• 11.1.4.2
• 11.1.4.3
• 11.1.4.4
• 11.1.4.5
• 11.1.4.6
• 11.1.4.7
• 11.5.0
• 11.5.1
• 11.5.2
• 11.5.3
• 11.5.4
• 11.5.5
• 11.5.6
• 11.5.7
• 11.5.8
• 11.5.9
• 12.1.0
• 12.1.1
• 12.1.2
• 12.1.3

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion