CVE-2025-36428
📋 TL;DR
This vulnerability in IBM Db2 allows authenticated users to cause a denial of service by exploiting improper input sanitization in the RPSCAN feature's data query logic. It affects Db2 versions 11.5.0-11.5.9 and 12.1.0-12.1.3 on Linux, UNIX, and Windows systems. Only systems with the RPSCAN feature enabled are vulnerable.
💻 Affected Systems
- IBM Db2 for Linux, UNIX and Windows
- IBM Db2 Connect Server
📦 What is this software?
Db2 by Ibm
Db2 by Ibm
Db2 by Ibm
Db2 by Ibm
Db2 by Ibm
Db2 by Ibm
⚠️ Risk & Real-World Impact
Worst Case
Complete database unavailability affecting all applications and users relying on the Db2 instance, potentially causing business disruption.
Likely Case
Temporary service degradation or database crashes requiring restart, impacting application performance.
If Mitigated
Minimal impact if RPSCAN is disabled or proper access controls limit authenticated user privileges.
🎯 Exploit Status
Exploitation requires authenticated database access and knowledge of RPSCAN query patterns. No public exploit code is available as of analysis.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply fixes from IBM: 11.5.9.1 or later for 11.5.x, 12.1.3.1 or later for 12.1.x
Vendor Advisory: https://www.ibm.com/support/pages/node/7257697
Restart Required: Yes
Instructions:
1. Review IBM advisory for specific fix details. 2. Apply the appropriate fix pack for your Db2 version. 3. Restart Db2 services to apply changes. 4. Verify the fix is applied correctly.
🔧 Temporary Workarounds
Disable RPSCAN feature
allTemporarily disable the RPSCAN feature if not required for operations
db2 update dbm cfg using RPSCAN OFF
db2stop
db2start
🧯 If You Can't Patch
- Restrict database user privileges to minimize authenticated users who could exploit this vulnerability
- Implement network segmentation and firewall rules to limit access to Db2 instances
🔍 How to Verify
Check if Vulnerable:
Check Db2 version with 'db2level' command and verify if RPSCAN is enabled in database configurationCheck Version:
db2level | grep 'Product level'Verify Fix Applied:
Verify applied fix pack version and confirm RPSCAN configuration after applying patches📡 Detection & Monitoring
Log Indicators:
- Database crash logs
- RPSCAN-related error messages in db2diag.log
- Unexpected service restarts
Network Indicators:
- Unusual database query patterns from authenticated users
- Increased failed connection attempts
SIEM Query:
source="db2" AND (error OR crash OR "denial of service")