CVE-2025-36442
📋 TL;DR
IBM Db2 databases running vulnerable versions can crash when processing specially crafted XML queries, causing denial of service. This affects Db2 11.5.0-11.5.9 and 12.1.0-12.1.3 on Linux, UNIX, and Windows systems, including Db2 Connect Server installations.
💻 Affected Systems
- IBM Db2 for Linux, UNIX and Windows
- IBM Db2 Connect Server
📦 What is this software?
Db2 by Ibm
Db2 by Ibm
Db2 by Ibm
Db2 by Ibm
Db2 by Ibm
Db2 by Ibm
⚠️ Risk & Real-World Impact
Worst Case
Complete database unavailability requiring restart, potentially disrupting critical business operations and causing data access outages.
Likely Case
Intermittent database crashes affecting application availability, requiring manual intervention to restart Db2 services.
If Mitigated
Minimal impact with proper network segmentation and query validation preventing malicious queries from reaching the database.
🎯 Exploit Status
Exploitation requires database access and ability to execute XML queries. No public exploit code is currently available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply fixes from IBM: 11.5.9.0a or later for 11.5.x, 12.1.3.0a or later for 12.1.x
Vendor Advisory: https://www.ibm.com/support/pages/node/7257698
Restart Required: Yes
Instructions:
1. Download appropriate fix from IBM Fix Central. 2. Apply fix using Db2 update installer. 3. Restart all Db2 instances and dependent applications. 4. Verify fix with version check.
🔧 Temporary Workarounds
Restrict XML Query Access
allImplement database access controls to limit XML query execution to trusted users only.
db2 "REVOKE EXECUTE ON PROCEDURE SYSPROC.XMLVALIDATE FROM PUBLIC"
db2 "REVOKE EXECUTE ON PROCEDURE SYSPROC.XMLPARSE FROM PUBLIC"
Network Segmentation
allIsolate Db2 servers behind firewalls and restrict access to trusted application servers only.
🧯 If You Can't Patch
- Implement strict input validation on all applications that submit XML queries to Db2
- Deploy network-based intrusion prevention systems to detect and block malicious XML payloads
🔍 How to Verify
Check if Vulnerable:
Check Db2 version: db2level command output showing versions 11.5.0-11.5.9 or 12.1.0-12.1.3Check Version:
db2level | grep "Product installed"Verify Fix Applied:
Verify version is 11.5.9.0a or higher for 11.5.x, or 12.1.3.0a or higher for 12.1.x📡 Detection & Monitoring
Log Indicators:
- Db2 instance crashes in db2diag.log
- Unexpected termination of db2sysc process
- Error messages related to XML parsing failures
Network Indicators:
- Unusual XML query patterns to Db2 ports
- Multiple connection attempts followed by service unavailability
SIEM Query:
source="db2diag.log" AND ("crash" OR "terminated" OR "XML parsing error")