CVE-2025-2534: IBM Db2 denial of service
IBM Db2 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.
Other sources
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Db2 V11.1to a version that resolves this vulnerability.Patch DT422178 - Upgrade
Upgrade
IBM Db2 V11.5to a version that resolves this vulnerability.Patch DT422178 - Upgrade
Upgrade
IBM Db2 V12.1to a version that resolves this vulnerability.Fixed in 12.1.3Patch DT422178
Event History
Frequently Asked Questions
What is the severity of CVE-2025-2534?
The severity of CVE-2025-2534 is classified as high due to the potential for denial of service causing the server to crash.
How do I fix CVE-2025-2534?
To fix CVE-2025-2534, you must apply the latest security patches from IBM for your affected version of Db2.
Which versions of IBM Db2 are affected by CVE-2025-2534?
CVE-2025-2534 affects IBM Db2 versions 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3.
What kind of attack does CVE-2025-2534 expose the server to?
CVE-2025-2534 exposes the server to denial of service attacks, which can cause it to crash when handling specially crafted queries.
Is there a workaround for CVE-2025-2534?
Currently, there are no documented workarounds for CVE-2025-2534; applying security patches is the recommended action.