IBM Db2
CVE-2025-2534
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Db2 network listener
-
DeliveryEstablish database session
-
ExploitSubmit specially crafted query
-
ExecutionTrigger excessive memory allocation
-
ImpactCrash server and deny service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Memory allocation limits
|
| Exploitation Conditions | Exploitation requires the ability to deliver a specially crafted query to an affected Db2 11.1.x, 11.5.x, or 12.1.x instance (including Db2 Connect Server) on Linux, UNIX, or Windows, which triggers excessive memory allocation (CWE-789) and crashes the server. The practical prerequisite is network reachability to the Db2 listener and a means to submit SQL to it; although IBM scored this PR:N, issuing a query normally requires a valid database connection, so the realistic limiting factor is access to an authenticated or otherwise query-capable session. Impact is limited to availability - no data disclosure or modification - and exposure is reduced where the Db2 port is firewalled to trusted application tiers rather than open to untrusted networks. |
| Impact | Signals point to a moderate, availability-only risk rather than a top-tier emergency. The CVSS 3.1 base score of 7.5 is driven entirely by the availability impact (A:H) of a remotely reachable crash (AV:N/AC:L/PR:N/UI:N), with no confidentiality or integrity impact (C:N/I:N). Corroborating exploitation signals are weak: EPSS is just 0.10% (28th percentile), there is no CISA KEV listing, and no public proof-of-concept was provided - so the probability of near-term widespread exploitation is low. The most important tension is the privilege metric: IBM/NVD scored this PR:N (unauthenticated), yet the root cause is a 'specially crafted query,' which normally presupposes an authenticated database session capable of issuing SQL. This is a conflict worth verifying - if a valid Db2 connection is genuinely required, the realistic privilege requirement is PR:L and the effective risk is lower than a pure unauthenticated-network DoS. SSVC-style reading: technical impact is partial (service crash, not code execution or data loss), automatable is likely 'no' (requires a crafted query against a reachable instance), exploitation status is 'none' observed. Net: a legitimate patch-management item for exposed Db2 servers, not a drop-everything scenario. |
| Exploit ScenarioDerived | An attacker with network reachability to a Db2 (or Db2 Connect Server) instance submits a specially crafted query that triggers excessive/uncontrolled memory allocation (CWE-789), causing the database server process to crash and denying service to all users. No public exploit code was identified; exploitation likely requires the ability to send a query to the listener, which in practice usually means a valid database session. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 07, 2026
A crafted SQL query can crash IBM Db2 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 on Linux, UNIX, and Windows - including Db2 Connect Server - producing a full denial of service against the database instance. The root cause is CWE-789 (uncontrolled memory allocation): the server attempts an excessive allocation when processing the specially crafted query and terminates. IBM's published vector scores this 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), while our assessment places the realistic vector at PR:L, since delivering the malicious query in practice requires a valid, query-capable database session rather than an anonymous network packet; the practical barrier is therefore access to an authenticated connection plus network reachability to the Db2 listener. There is no CISA KEV listing and no public exploit code identified at time of analysis, and EPSS is low at 0.10% (28th percentile), so this reads as a moderate, availability-only risk rather than an emergency - but any crash of a production Db2 instance is business-impacting, so patching on a normal maintenance cadence remains appropriate.
Earlier versions of this analysis (1)
IBM Db2 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as the server may. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. No vendor patch available.
RemediationAI
IBM publishes fix information for this issue through its support advisory at https://www.ibm.com/support/pages/node/7250472; no exact patched version number is confirmed in the available data, so administrators should consult that advisory and apply the Db2 fix pack or special build IBM lists for their specific 11.1.x, 11.5.x, or 12.1.x installation, including Db2 Connect Server. Where patching cannot be performed immediately, the most effective compensating control is network restriction: firewall the Db2 listener port (commonly TCP 50000) so only trusted application tiers can reach the instance, and require database access to traverse a proxy or connection pool rather than being directly reachable - the trade-off is that any application not covered by the new rules loses connectivity and rule sets must be maintained as tiers change. Reducing the population of accounts that can submit arbitrary SQL and reviewing any application path that concatenates user input into queries also narrows the attack surface, at the cost of application changes and user friction. Because the impact is availability-only and no public exploit is known, these measures can be staged on a normal maintenance cadence, but monitoring for unexpected db2sysc restarts or instance outages provides early warning if exploitation is attempted.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM Db2 is a relational database management system whose server process (db2sysc) parses and optimizes incoming SQL over the database listener, historically on TCP port 50000. CVE-2025-2534 is classified as CWE-789, allocation of resources without limits or throttling with an excessive size value: the query parser/optimizer accepts a specially crafted statement and attempts a memory allocation far larger than is reasonable, exhausting memory or hitting an internal limit and terminating the server process instead of failing the statement gracefully. The CPE data confirms the affected products as ibm:db2 builds targeting linux, unix, and windows, and IBM's description explicitly includes Db2 Connect Server, meaning both the core Db2 server on LUW and the gateway/connectivity server tier are in scope. Because the defect sits in query handling rather than in authentication or encryption code, the primary impact is process termination (CVSS impact C:N/I:N/A:H) with no confidentiality or integrity loss, and repeated submissions could keep an instance persistently unavailable. No authentication bypass or privilege escalation primitive is described, which is why the assessment treats the realistic prerequisite as the ability to submit SQL - either an authenticated session or an application path that forwards user-controlled query content to the database.
Know when Db2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote crafted query over the network (AV:N/AC:L) typically needs a valid Db2 session, so PR:L; impact is availability-only server crash (A:H, C:N/I:N).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
IBM Db2 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.
Executive ViewAI
IBM Db2 database instances across Linux, UNIX, and Windows platforms, including Db2 Connect Server, are affected by a high-severity denial-of-service vulnerability that can crash the database when processing a specially crafted SQL query. This poses a risk of unplanned downtime for critical business applications dependent on Db2. Although no public exploit identified at time of analysis, the absence of a vendor patch warrants immediate mitigation efforts.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting network access to the Db2 listener to trusted hosts, enforcing strong authentication and least privilege for database accounts, enabling query monitoring to detect anomalous SQL patterns, and isolating critical Db2 instances through network segmentation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)NVD
Stack-based buffer overflow in the SQL/PSM (aka SQL Persistent Stored Module) Stored Procedure (SP) infrastructure in IB
IBM DB2 for Linux, UNIX and Windows 9.2, 10.1, 10.5, and 11.1 (includes DB2 Connect Server) is vulnerable to a stack-bas
Stack-based buffer overflow in IBM DB2 9.7 through FP9a, 9.8 through FP5, 10.1 through FP4, and 10.5 before FP4 on Linux
IBM DB2 9.5 uses world-writable permissions for nodes.reg, which has unspecified impact and attack vectors. Rated critic
Remote code execution in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.4 lets unauthenticated network attackers run arbitrary co
Privilege escalation in IBM Db2 (data server versions 11.5.0-11.5.9 and 12.1.0-12.1.5) allows an attacker to submit a sp
Memory-corruption in IBM Db2's IXF file IMPORT parser lets an attacker supply a crafted IXF data file that overflows a s
Stack-based buffer overflow in the Java Stored Procedure infrastructure in IBM DB2 9.1 before FP12, 9.5 through FP9, 9.7
Directory traversal vulnerability in the UTL_FILE module in IBM DB2 and DB2 Connect 10.1 before FP1 on Windows allows re
IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) duplicates the PRNG state across fork() system
Integer signedness error in the db2dasrrm process in the DB2 Administration Server (DAS) in IBM DB2 9.1 through FP11, 9.
The Stored Procedure infrastructure in IBM DB2 9.5, 9.7 before FP9a, 10.1 before FP3a, and 10.5 before FP3a on Windows a
GitHub PoC
Exploit-DB