CVE-2025-1992: IBM Db2 denial of service
First published: Mon May 05 2025(Updated: )
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 could allow an authenticated user, under non default configurations, to cause a denial of service due to insufficient release of allocated memory after usage.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM DB2 Universal Database | >=11.5.0<=11.5.9>=12.1.0<=12.1.1 | |
| IBM Db2 | <=11.5.0 - 11.5.9 | |
| IBM Db2 | <=12.1.0 - 12.1.1 |
Remedy
Customers running any vulnerable affected level of an affected Program, V11.5 and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V11.5.9 and V12.1.1. They can be applied to any affected level of the appropriate release to remediate this vulnerability.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-1992?
CVE-2025-1992 has been classified as a medium severity vulnerability due to its potential to cause a denial of service.
How do I fix CVE-2025-1992?
To mitigate CVE-2025-1992, ensure that your IBM Db2 version is updated to a version that is not affected by this vulnerability.
Who is affected by CVE-2025-1992?
CVE-2025-1992 affects authenticated users of IBM Db2 for Linux, UNIX, and Windows versions 11.5.0 to 11.5.9 and 12.1.0 to 12.1.1 under non-default configurations.
What type of vulnerability is CVE-2025-1992?
CVE-2025-1992 is a resource management vulnerability that can lead to a denial of service due to insufficient memory release.
What version of IBM Db2 is vulnerable to CVE-2025-1992?
Versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 of IBM Db2 are vulnerable to CVE-2025-1992.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/remedy
- agent/weakness
- agent/title
- agent/type
- agent/guess-ai
- agent/software-canonical-lookup
- agent/first-publish-date
- agent/description
- collector/ibm-support
- source/IBM
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/severity
- agent/author
- agent/source
- agent/tags
- agent/event
- vendor/ibm
- canonical/ibm db2 universal database
- canonical/ibm db2
- version/ibm db2/11.5.0 - 11.5.9
- version/ibm db2/12.1.0 - 12.1.1