CVE-2025-36136: IBM denial of service
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local user to cause a denial of service due to the database monitor script incorrectly detecting that the instance is still starting under specific conditions.
Other sources
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local user to cause a denial of service due to the database monitor script incorrectly detecting that the instance is still starting under specific conditions.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Db2 11.5 for Linux, UNIX and Windowsto a version that resolves this vulnerability.Patch DT435369 Special Build #69673 or later - Upgrade
Upgrade
IBM Db2 12.1 for Linux, UNIX and Windowsto a version that resolves this vulnerability.Patch DT435369 Special Build #70120 or later
Event History
Frequently Asked Questions
What is the severity of CVE-2025-36136?
CVE-2025-36136 is classified as a medium severity vulnerability due to its potential to cause a denial of service.
How do I fix CVE-2025-36136?
To fix CVE-2025-36136, upgrade IBM Db2 to version 11.5.10 or 12.1.4 or later to mitigate the vulnerability.
What versions of IBM Db2 are affected by CVE-2025-36136?
CVE-2025-36136 affects IBM Db2 versions 11.5.0 to 11.5.9 and 12.1.0 to 12.1.3.
What is the impact of CVE-2025-36136 on affected systems?
The impact of CVE-2025-36136 is a denial of service, which can cause disruptions in database operations.
Can CVE-2025-36136 be exploited remotely?
CVE-2025-36136 requires local access to exploit, making it less of a risk from remote attacks.