CVE-2025-36122

🗓️ 27 May 2026 20:13:38Reported by redhat.comType

CVE-2025-36122 affects IBM Db2 versions 11.5.0–11.5.9 and 12.1.0–12.1.3 on Linux, UNIX, Windows; authenticated users may cause a denial of service via a crafted query due to improper resource allocation.

Reporter	Title	Published	Views	Family All 20
IBM Security Bulletins	Security Bulletin: There are multiple vulnerabilities in IBM DB2 bundled with IBM Application Performance Management products.	21 May 202614:00	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Db2 and IBM Java SDK used by IBM Security Verify Governance contain multiple vulnerabilities	21 Aug 202609:25	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities have been identified in IBM Db2 shipped with IBM Guardium Key Lifecycle Manager (SKLM/GKLM)	6 May 202613:53	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities have been identified in IBM DB2 shipped with IBM WebSphere Remote Server	5 May 202616:22	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of IBM Db2, IBM Cloud Pak System is affected by multiple vulnerabilities	21 Oct 202600:01	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Db2 may affect IBM Storage Protect Server.	31 Jul 202620:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Tivoli Netcool Impact and IBM Tivoli Business Service Manager is vulnerable to multiple vulnerabilities due to DB2 JDBC Driver	1 Jul 202617:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Db2® is vulnerable to a denial of service with a specially crafted query when stmtheap is set to automatic (CVE-2025-36122)	5 Aug 202620:04	–	ibm
attackerkb	CVE-2025-36122	30 Apr 202621:48	–	attackerkb
Circl	CVE-2025-36122	30 Apr 202622:52	–	circl

Source	Link
cve	www.cve.org/CVERecord

27 May 2026 20:13Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.16.5

EPSS0.00245

SSVC