Login Sign Up

CVE-2025-1992

5.3 MEDIUM
Denial of Service

📋 TL;DR

This vulnerability in IBM Db2 allows authenticated users in a federation environment to cause a denial of service by exploiting insufficient memory release after usage. It affects Db2 versions 11.5.0-11.5.9 and 12.1.0-12.1.1 on Linux, UNIX, and Windows systems. The attack requires authentication and federation configuration.

💻 Affected Systems

Products:
  • IBM Db2 for Linux, UNIX and Windows
  • DB2 Connect Server
Versions: 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1
Operating Systems: Linux, UNIX, Windows
Default Config Vulnerable: ✅ No
Notes: Requires federation environment configuration and authenticated user access.

📦 What is this software?

Db2 by Ibm

View all CVEs affecting Db2 →

Db2 by Ibm

View all CVEs affecting Db2 →

Db2 by Ibm

View all CVEs affecting Db2 →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete database service disruption leading to application downtime and business impact.

🟠

Likely Case

Degraded database performance or intermittent service interruptions in targeted federation scenarios.

🟢

If Mitigated

Minimal impact with proper access controls and monitoring in place.

🌐 Internet-Facing: LOW - Requires authenticated access and federation environment.
🏢 Internal Only: MEDIUM - Internal authenticated users in federation setups could exploit.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ✅ No
Complexity: MEDIUM

Requires specific federation configuration and authenticated access.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Apply fixes from IBM APARs listed in advisory

Vendor Advisory: https://www.ibm.com/support/pages/node/7232515

Restart Required: Yes

Instructions:

1. Review IBM advisory for specific APARs. 2. Apply recommended fixes from IBM. 3. Restart Db2 services. 4. Verify patch application.

🔧 Temporary Workarounds

Restrict Federation Access

all

Limit authenticated user access to federation features

Review and modify user privileges using db2 commands: db2 "REVOKE USE OF FEDERATION ON SERVER FROM USER <username>"

🧯 If You Can't Patch

  • Implement strict access controls to limit federation feature usage
  • Monitor memory usage and restart services if abnormal patterns detected

🔍 How to Verify

Check if Vulnerable:

Check Db2 version: db2level command and compare with affected versions 11.5.0-11.5.9 or 12.1.0-12.1.1

Check Version:

db2level

Verify Fix Applied:

Verify version after patching and check for applied APARs via db2support command

📡 Detection & Monitoring

Log Indicators:

  • Abnormal memory consumption patterns in Db2 diagnostic logs
  • Federation operation failures

Network Indicators:

  • Unusual federation query patterns from authenticated users

SIEM Query:

source="db2*" AND (memory_usage>threshold OR error_code="memory")

📊 Metadata

CVE ID: CVE-2025-1992
CVSS v3 Score: 5.3 (MEDIUM)
CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE: CWE-401
EPSS Score: 0.06% exploit probability (17th percentile)
Published: May 5, 2025
Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-1992, you might also want to check these:

CVE-2021-40633 8.8

CVE-2021-40633 is a memory leak vulnerability in gif2rgb, a utility in giflib 5.1.4, allowing remote...

Same vulnerability type (CWE-401)
CVE-2021-3492 8.8

CVE-2021-3492 is a kernel vulnerability in Ubuntu's Shiftfs filesystem where improper error handling...

Same vulnerability type (CWE-401)
CVE-2024-25450 8.8

CVE-2024-25450 is a memory allocation vulnerability in imlib2 v1.9.1's init_imlib_fonts() function t...

Same vulnerability type (CWE-401)