CVE-2025-36185: IBM Db2 denial of service
IBM Db2 12.1.0 through 12.1.2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a local user to cause a denial of service due to improper neutralization of special elements in data query logic.
Other sources
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a local user to cause a denial of service due to improper neutralization of special elements in data query logic.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Db2to a version that resolves this vulnerability.Fixed in 12.1.2
Event History
Frequently Asked Questions
What is the severity of CVE-2025-36185?
The severity of CVE-2025-36185 is classified as medium due to its potential to cause denial of service.
How do I fix CVE-2025-36185?
To fix CVE-2025-36185, upgrade IBM Db2 to version 12.1.3 or later to address the vulnerability.
Who is affected by CVE-2025-36185?
CVE-2025-36185 affects local users of IBM Db2 versions 12.1.0 through 12.1.2 for Linux, UNIX, and Windows.
What type of vulnerability is CVE-2025-36185?
CVE-2025-36185 is a denial of service vulnerability caused by improper neutralization of special elements in data query logic.
Is there a workaround for CVE-2025-36185?
Currently, there are no documented workarounds for CVE-2025-36185; upgrading to a patched version is recommended.