CVE-2025-36442
Ibm Db2 11.5.0 – 11.5.9
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2025-36442 is a medium-severity Improper Neutralization of Special Elements in Data Query Logic (CWE-943) vulnerability in Ibm Db2. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-36442 is a denial-of-service vulnerability affecting IBM Db2 for Linux, UNIX, and Windows, including Db2 Connect Server, in versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3. The issue arises when the server processes a specially crafted query involving XML columns under certain conditions, potentially causing a crash. It carries a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) and is linked to CWE-943 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ("Injection")) with additional NVD-CWE-noinfo classification. The vulnerability was published on 2026-01-30.
An attacker requires low privileges (PR:L) and can exploit this remotely over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). By submitting the crafted query, the attacker can crash the Db2 server, achieving high-impact denial of service (A:H) through availability disruption, with no effects on confidentiality or integrity and no change in scope (S:U).
IBM's security advisory at https://www.ibm.com/support/pages/node/7257698 provides details on the vulnerability, affected versions, and recommended mitigations, including available patches.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206567
Vulnerability Data
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query with XML…
more
columns.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Input validation directly stops unneutralized special elements from reaching query logic.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require parameterized queries and input neutralization to prevent query-logic injection.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches injection vulnerabilities before release but does not itself implement the fix.
Secure development life cycle mandates input validation and query parameterization that directly prevent injection flaws.
Application security requirements explicitly call for controls against injection and improper query construction.
Secure architecture principles reduce the likelihood of query-logic flaws but do not prescribe the specific coding practice.
Secure coding standards require proper neutralization of special elements in all data queries.
Outsourced development agreements can require secure coding practices, indirectly mitigating the weakness.