PT-2026-5445 · Ibm · Db2 For Linux+1

Published 2026-01-30 · Updated 2026-01-31 · CVE-2025-36001

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) versions 11.5.0 through 11.5.9 IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) versions 12.1.0 through 12.1.3

Description An authenticated user can trigger a denial of service by submitting a specifically designed SQL statement containing XML that leads to uncontrolled recursion.

Recommendations Update IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) to a version later than 11.5.9. Update IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) to a version later than 12.1.3.

Fix

DoS

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

CVE-2025-36001

Affected Products

Db2 Connect Server

Db2 For Linux

References · 9

• https://osv.dev/vulnerability/UBUNTU-CVE-2025-36001 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-36001 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-36001 · Security Note
• https://ubuntu.com/security/CVE-2025-36001 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-36001 · Vendor Advisory
• https://ibm.com/support/pages/node/7257616 · Patch, Vendor Advisory
• https://t.me/cveNotify/150471 · Telegram Post
• https://t.me/CVEtracker/43342 · Telegram Post
• https://twitter.com/CVEnew/status/2017354525305180356 · Twitter Post