PT-2026-5461 · Ibm · Db2 For Linux+1

Published 2026-01-30 · Updated 2026-01-31 · CVE-2025-36442

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) versions 11.5.0 through 11.5.9 IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) versions 12.1.0 through 12.1.3

Description The software may experience a denial of service if it receives a specially crafted query containing XML columns. This can cause the server to crash under specific conditions.

Recommendations IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) versions 11.5.0 through 11.5.9 should be updated. IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) versions 12.1.0 through 12.1.3 should be updated.

Fix

DoS

Weakness Enumeration

CWE-943

Related Identifiers

CVE-2025-36442

Affected Products

Db2 Connect Server

Db2 For Linux

References · 9

• https://osv.dev/vulnerability/CVE-2025-36442 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-36442 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-36442 · Security Note
• https://ubuntu.com/security/CVE-2025-36442 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-36442 · Vendor Advisory
• https://ibm.com/support/pages/node/7257698 · Patch, Vendor Advisory
• https://twitter.com/CVEnew/status/2017354541646197063 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2017375198928879887 · Twitter Post
• https://t.me/CVEtracker/43326 · Telegram Post