Latest vulnerabilities for "ibm db2"

Where

Sort:

IBM DB2IBM® Db2® is vulnerable to privilege escalation with a specially crafted query

Risk 86

Severity

9.8

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation with a specially crafted query.

1 / 2

Source: MITRE

First published (updated )

CVE-2026-10543

IBM DB2IBM® Db2® federated server could allow a local attacker to obtain sensitive information due to the logging of plain text passwords in trace files.

Risk 32

Severity

5.5

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to obtain sensitive information due to the logging of plain text passwords in trace files.

1 / 2

Source: IBM

First published (updated )

CVE-2026-18097

IBM DB2IBM® Db2® is affected by an improper authorization vulnerability in the certain command, allowing a non-privileged user to bypass authority checks and modify database catalog data.

Risk 48

Severity

7.1

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is affected by an improper authorization vulnerability in the certain command, allowing a non-privileged user to bypass authority checks and modify database catalog data.

1 / 2

Source: MITRE

First published (updated )

CVE-2026-16480

IBM DB2IBM® Db2® is vulnerable to buffer overflow in the IXF IMPORT parser

Risk 86

Severity

9.8

Buffer Overflow

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Db2 is vulnerable to buffer overflow in the IXF IMPORT parser.

1 / 2

Source: IBM

First published (updated )

CVE-2026-10534

IBM DB2IBM® Db2® is vulnerable to buffer overflow in setgid helper db2flacc which can lead to privilege escalation and instance compromise from an unprivileged shell

Risk 74

Severity

8.4

Buffer Overflow

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to buffer overflow in setgid helper db2flacc.

1 / 2

Source: MITRE

First published (updated )

CVE-2026-10535

IBM DB2IBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control

Risk 51

Severity

7.8

EPSS

0.17%

Code Injection

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

IBM Data Server Driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control.

1 / 2

Source: IBM

First published (updated )

CVE-2026-9762

IBM IBM® Db2®IBM® Db2® is vulnerable to a trap when compiling specially crafted statements containing subqueries could lead to a denial of service

Risk 31

Severity

5.5

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a trap when compiling a specially crafted statements containing subqueries could lead to a denial of service.

1 / 2

Source: MITRE

First published (updated )

CVE-2026-7771

IBM Db2 12.1.0 through 12.1.4 federated serverIBM® Db2® is vulnerable to a denial of service when running non fenced federated queries

Risk 36

Severity

6.2

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

IBM Db2 12.1.0 through 12.1.4 federated server is vulnerable to a denial of service when running non fenced federated queries.

1 / 2

Source: MITRE

First published (updated )

CVE-2026-10695

IBM DB2IBM® Db2® could disclose sensitive information to an authenticated user from the monitoring and event tables

Risk 38

Severity

6.5

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 Connect Server) could disclose sensitive information to an authenticated user from the monitoring and event tables.

1 / 2

Source: MITRE

First published (updated )

CVE-2025-36372

IBM DB2IBM® Db2® federated server is vulnerable to a denial of service due to improper neutralization of special elements in the data query logic of XMLTable-derived columns by autheticated user

Risk 38

Severity

6.5

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in the data query logic of XMLTable-derived columns.

1 / 2

Source: MITRE

First published (updated )

CVE-2026-11906

IBM DB2IBM® Db2® is vulnerable to remote code execution due to improper pre-auth DRDA handshake handling

Risk 86

Severity

9.8

Code Injection

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution due to improper pre-auth DRDA handshake handling.

1 / 2

Source: MITRE

First published (updated )

CVE-2026-10109

IBM IBM® Db2® on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for DataMultiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data.

Risk 38

Severity

6.5

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8,5.0,5.1,5.2,5.3 could allow an authenticated user to cause a denial of service when creating new databases due to improper allocation of resources.

1 / 2

Source: MITRE

First published (updated )

CVE-2024-54178

IBM IBM® Db2® on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for DataMultiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data.

Risk 49

Severity

6.5

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L

IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8, 5.0, 5.1, 5.2, 5.3 could allow a privileged user to perform operations and obtain sensitive information outside of their authority due to improper token validation.

1 / 2

Source: MITRE

First published (updated )

CVE-2025-2669

IBM IBM® Db2® on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for DataMultiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data.

Risk 32

Severity

5.3

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8, 5.0, 5.1, 5.2, and 5.3 could allow an authenticated user to bypass client-side validation and manipulate input data using man in the middle techniques.

1 / 2

Source: MITRE

First published (updated )

CVE-2023-33854

IBM DB2IBM® Db2® is vulnerable to authorization bypass when uploading to a remote object storage path with a special query

Risk 43

Severity

7.5

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

IBM Db2 12.1.0 through 12.1.4 is vulnerable to authorization bypass when uploading to a remote object storage path with a special query.

First published (updated )

CVE-2026-6938

IBM DB2IBM® Db2® is vulnerable to a denial of service when a specially crafted query is run with range partitioned tables

Risk 32

Severity

5.5

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a denial of service when a specially crafted query is run with range partitioned tables.

First published (updated )

CVE-2026-6053

IBM DB2IBM® Db2® is vulnerable to running out of memory when executing certain queries with MDC tables

Risk 43

Severity

7.5

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to running out of memory when executing certain queries with MDC tables.

First published (updated )

CVE-2026-6052

IBM DB2IBM® Db2® is vulnerable to a denial of service when executing a specially crafted query with a small statement heap

Risk 43

Severity

7.5

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a denial of service when executing a specially crafted query with a small statement heap.

First published (updated )

CVE-2026-6051

IBM DB2IBM® Db2® is vulnerable to a denial of service with a specially crafted query when running an AUTONOMOUS procedure

Risk 43

Severity

7.5

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a denial of service with a specially crafted query when autonomous transactions are enabled.

1 / 2

Source: MITRE

First published (updated )

CVE-2026-1718

IBM DB2IBM® Db2® is vulnerable to a denial of service with a specially crafted query when stmtheap is set to automatic

Risk 38

Severity

6.5

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow an authenticated user to cause a denial of service using a specially crafted SQL query due to improper allocation of system resources.

1 / 2

Source: MITRE

Remedy

Customers running any vulnerable affected level of an affected Program, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V11.5.9. They can be applied to any affected level of the appropriate release to remediate this vulnerability. ReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 V12.1 V12.1.4 https://www.ibm.com/support/pages/node/7267513 Note: To apply this fix, it is required to set DB2_STRICT_INSTANCE_MEMORY=ON in addition to installing the above Special Build. IBM does not disclose key Db2 functionality nor replication steps for a vulnerability to avoid providing too much information to any potential malicious attacker. IBM does not want to enable a malicious attacker with sufficient knowledge to craft an exploit of the vulnerability.

First published (updated )

CVE-2025-36122

IBM DB2IBM® Db2® is vulnerable to a trap or return SQLCODE -901 when compiling a specially crafted query with a defined index

Risk 38

Severity

6.5

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

1 / 2

Source: MITRE

Remedy

Customers running any vulnerable affected level of an affected Program, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V11.5.9, and V12.1.4. They can be applied to any affected level of the appropriate release to remediate this vulnerability. ReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 V12.1 TBD https://www.ibm.com/support/pages/node/7267513 IBM does not disclose key Db2 functionality nor replication steps for a vulnerability to avoid providing too much information to any potential malicious attacker. IBM does not want to enable a malicious attacker with sufficient knowledge to craft an exploit of the vulnerability.

First published (updated )

CVE-2026-1352

IBM DB2IBM® Db2® is vulnerable to a denial of service when fetching from certain tables under specific configurations

Risk 32

Severity

5.3

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in data query logic when certain configurations exist.

1 / 2

Source: MITRE

Remedy

Customers running any vulnerable affected level of an affected Program, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V11.5.9. They can be applied to any affected level of the appropriate release to remediate this vulnerability. ReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 V12.1 V12.1.4 https://www.ibm.com/support/pages/node/7267513 IBM does not disclose key Db2 functionality nor replication steps for a vulnerability to avoid providing too much information to any potential malicious attacker. IBM does not want to enable a malicious attacker with sufficient knowledge to craft an exploit of the vulnerability.

First published (updated )

CVE-2025-14688

IBM DB2IBM Db2 Denial of Service

Risk 38

Severity

6.5

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 is vulnerable to a denial of service as the server may crash when an authenticated user creates a specially crafted query.

1 / 2

Source: NVD

Remedy

Customers running any vulnerable affected level of an affected Program, V11.5 can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent affected level for each impacted release: V11.5.9. They can be applied to any affected mod pack level of the appropriate release to remediate this vulnerability. ReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 V12.1V12.1.2 & V12.1.3 https://www.ibm.com/support/pages/db2-v1212-published-cumulative-special-build-downloads 12.1.3 Latest https://www.ibm.com/support/pages/db2-v1213-published-cumulative-special-build-downloads

First published (updated )

CVE-2025-2668

IBM DB2IBM Db2 Denial of Service

Risk 36

Severity

6.2

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow a local user to cause a denial of service due to improper neutralization of special elements in data query logic.

1 / 2

Source: NVD

Remedy

Customers running any vulnerable modpack level of an affected Program, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V11.5.9, V12.1.2 and V12.1.3. They can be applied to any affected level of the appropriate release to remediate this vulnerability. ReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 V12.1TBD https://www.ibm.com/support/pages/db2-v1212-published-cumulative-special-build-downloads Special Build #71609 or later for V12.1.3 available at this link: https://www.ibm.com/support/pages/db2-v1213-published-cumulative-special-build-downloads

First published (updated )

CVE-2025-36353

IBM DB2IBM Db2 Denial of Service

Risk 36

Severity

6.2

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow a local user to cause a denial of service when copying large table containing XML data due to improper allocation of system resources.

1 / 2

Source: NVD

Remedy

ReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 V12.1 v12.1.3 https://www.ibm.com/support/pages/db2-v1212-published-cumulative-special-build-downloads 12.1.3 Latest https://www.ibm.com/support/pages/db2-v1213-published-cumulative-special-build-downloads

First published (updated )

CVE-2025-36123

IBM DB2IBM Db2 privilege escalation

Risk 69

Severity

7.8

AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

IBM Db2 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) under specific configurations could allow a local user to execute malicious code that escalate their privileges to root due to execution of unnecessary privileges operated at a higher than minimum level.

1 / 2

Source: MITRE

Remedy

Remediation/Fixes Customers running any vulnerable affected level of an affected Program, V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V12.1.2 and V12.1.3. They can be applied to any affected level of the appropriate release to remediate this vulnerability. Release Fixed in mod pack APAR Download URL V12.1 V12.1.3 DT445866 Special Build #70120 or later for V12.1.2 available at this link: https://www.ibm.com/support/pages/db2-v1212-published-cumulative-special-build-downloads IBM does not disclose key Db2 functionality nor replication steps for a vulnerability to avoid providing too much information to any potential malicious attacker. IBM does not want to enable a malicious attacker with sufficient knowledge to craft an exploit of the vulnerability. Note: After December 31, 2025, 11.1 and 10.5 versions of Db2 will not have security fixes made available as they will reach EoS.

First published (updated )

CVE-2025-36186

IBM Db2 LinuxIBM Db2 denial of service

Risk 43

Severity

7.5

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.

1 / 2

Source: MITRE

Remedy

Customers running any vulnerable affected level of an affected Program, V11.1, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent affected level for each impacted release: V11.1.4 FP7, V11.5.9, and V12.1.1. They can be applied to any affected mod pack level of the appropriate release to remediate this vulnerability.

First published (updated )

CVE-2024-49350

IBM Db2 LinuxIBM Db2 denial of service

Risk 43

Severity

7.5

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1

is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.

1 / 2

Source: MITRE

Remedy

First published (updated )

CVE-2025-2518

IBM Db2 LinuxIBM Db2 denial of service

Risk 38

Severity

6.5

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 could allow an authenticated user to cause a denial of service when using Q replication due to the improper allocation of CPU resources.

1 / 2

Source: MITRE

Remedy

First published (updated )

CVE-2025-3050

IBM DB2IBM Db2 denial of service

Risk 38

Severity

6.5

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 could allow an authenticated user in federation environment, to cause a denial of service due to insufficient release of allocated memory after usage.

1 / 2

Source: MITRE

Remedy

Customers running any vulnerable affected level of an affected Program, V11.5 and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V11.5.9 and V12.1.1. They can be applied to any affected level of the appropriate release to remediate this vulnerability.

First published (updated )

CVE-2025-1992

Trending

Versions

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Company

Resources

Contact