Security Bulletin: A vulnerability in module set-value affects IBM Db2 Big SQL on Cloud Pak for Data

Summary A vulnerability in node.js open source package set-value affects IBM Db2 Big SQL 7.4.2 and earlier on Cloud Pak for Data 4.6.2 and earlier Vulnerability Details CVEID:CVE-2021-23440 DESCRIPTION: Nodejs set-value module could allow a remote attacker to execute arbitrary code on the system,...

Security Bulletin: Multiple vulnerabilities that affect IBM Db2 Intelligence Center (CVE-2025-47913, CVE-2022-25927, CVE-2025-6493, CWE-400, CWE-1333, CVE-2025-14687

Summary Multiple vulnerabilties fixed with Db2 Intelligence Center 1.1.3. Vulnerability Details CVEID:CVE-2025-47913 DESCRIPTION: SSH clients receiving SSHAGENTSUCCESS when expecting a typed response will panic and cause early termination of the client process. CVSS Source: CISA ADP CVSS Base...

Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data

Summary IBM has released the below fix for IBM Db2® on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data in response to multiple vulnerabilities found in multiple components. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details...

Security Bulletin: Multiple vulnerabilities affect Data Virtualization on IBM Software Hub (December 2025)

Summary Multiple vulnerabilities have been addressed in Data Virtualization on IBM Software Hub. Note that Data Virtualization was named Watson Query on IBM Cloud Pak for Data version 4.8. Vulnerability Details CVEID:CVE-2025-8916 DESCRIPTION: Allocation of Resources Without Limits or Throttling...

Security Bulletin: IBM® Db2® is affected by a vulnerability in the mongo library (CVE-2025-0755)

Summary IBM® Db2® is affected by a vulnerability in MongoDB C driver library and may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size INT32MAX, resulting in a segmentation fault and possible applicatio...

Security Bulletin: IBM® Db2® is vulnerable to a denial of service using a specially crafted SQL statement (CVE-2025-33143).

Summary IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server could allow an authenticated user to cause a denial of service using a specially crafted SQL statement that performs uncontrolled recursion. Vulnerability Details CVEID:CVE-2025-33143 DESCRIPTION: IBM Db2 for Linux, UNIX and...

Security Bulletin: IBM® Db2® is vulnerable to denial of service when running federated queries with the certain condition (CVE-2025-36071)

Summary IBM® Db2® is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted federated query due to improper release of memory resources. Vulnerability Details CVEID:CVE-2025-36071 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows includes DB2...

Security Bulletin: IBM® Db2® is vulnerable to a stack-based buffer overflow (CVE-2025-33092)

Summary IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server is vulnerable to a stack-based buffer overflow in db2fm, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system. Vulnerability Details CVEID:CVE-2025-33092...

Security Bulletin: IBM® Db2® federated server is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query (CVE-2024-51473)

Summary IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server federated server is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query. Vulnerability Details CVEID:CVE-2024-51473 DESCRIPTION: IBM Db2 for Linux, UNIX and Window...

Security Bulletin: IBM® Db2® is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query (CVE-2024-49828)

Summary IBM® Db2® is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query. Vulnerability Details CVEID:CVE-2024-49828 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server is vulnerable to a denial of service as t...

Security Bulletin: IBM® Db2® is vulnerable to a denial of service as the server may crash under certain conditions (CVE-2025-2533)

Summary IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query. Vulnerability Details CVEID:CVE-2025-2533 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows includes Db2...

Security Bulletin: IBM® Db2® is vulnerable to a denial of service under specific conditions (CVE-2025-36010)

Summary IBM Db2 for Linux, UNIX and Windows includes DB2 Connect Server could allow an unauthenticated user to cause a denial of service due to executable segments that are waiting for each other to release a necessary lock. Vulnerability Details CVEID:CVE-2025-36010 DESCRIPTION: IBM Db2 for Linu...

Security Bulletin: IBM® Db2® is affected by a vulnerability in the corosync library. (CVE-2025-30472)

Summary If encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orftokenendianconvert in exec/totemsrp.c via a large UDP packet. Note, this vulnerability has been fixed in Corosync 3.1.7-3 for Db2 11.5.9 and Corosync 3.1.8-6 for Db2 12.1.2 and late...

Security Bulletin: IBM® Db2® is vulnerable to a denial of service with a specially crafted query. (CVE-2025-33114)

Summary IBM® Db2® is vulnerable to denial of service with a specially crafted query under certain non-default conditions. Vulnerability Details CVEID:CVE-2025-33114 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows includes DB2 Connect Server is vulnerable to denial of service with a specially...

Security Bulletin: IBM® Db2® is vulnerable to running out of memory under certain conditions (CVE-2025-33134)

Summary IBM® Db2® for Linux, UNIX and Windows includes Db2 Connect Server has a certain table function that leaks 4KB of memory each time it is called. Repetitively calling this functionality may eventually lead to a denial of service of the Db2 Server. Note that only users who have authenticated...

Security Bulletin: IBM® Db2® is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query (CVE-2025-2534)

Summary IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query. Vulnerability Details CVEID:CVE-2025-2534 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows includes Db2...

Security Bulletin: IBM® Db2® is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query (CVE-2024-47118)

Summary IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query. Vulnerability Details CVEID:CVE-2024-47118 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows includes Db2...

Security Bulletin: IBM® Db2® federated server is affected by a vulnerability in json-smart 2.5.0 (CVE-2024-57699)

Summary IBM® Db2® federated server is vulnerable to a security issue that was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted JSON input, containing a large number of '', a stack exhaustion can be triggered, which could allow an attacker to cause a Denial of...

Security Bulletin: IBM® Db2® Pacemaker is vulnerable to a denial of service due to improper allocation of resources (CVE-2025-36008)

Summary IBM® Db2® could allow an authenticated user to cause a denial of service due to improper allocation of resources. Note that this only affects users running Highly Available automation using Pacemaker. This includes Mutual Failover, High Availability Disaster Recovery HADR, pureScale or...

Security Bulletin: IBM® Db2® is vulnerable to privilege escalation under specific configurations (CVE-2025-36186)

Summary IBM® Db2® under specific configurations could allow a local user to execute malicious code that escalate their privileges to root due to execution of unnecessary privileges operated at a higher than minimum level. Vulnerability Details CVEID:CVE-2025-36186 DESCRIPTION: IBM Db2 for Linux,...