CVE-2025-36116

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 GUI is affected by cross-site WebSocket hijacking vulnerability. By sending a specially crafted request, an unauthenticated malicious actor could exploit this vulnerability to sniff an existing WebSocket connection to then remotely perform operations that th...

CVE-2025-36117

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 does not disallow the session id after use which could allow an authenticated user to impersonate another user on the system...

Security Bulletin: Db2 Query Management Facility is vulnerable to IBM Semeru Runtime Quarterly CPU - Apr 2025 - Includes OpenJDK April 2025 CPU

Summary Db2 Query Management Facility is vulnerable to IBM Semeru Runtime Quarterly CPU - Apr 2025 - Includes OpenJDK April 2025 CPU plus CVE-2025-21587, CVE-2025-30698, CVE-2025-2900, and CVE-2025-4447 Vulnerability Details CVEID:CVE-2025-21587 DESCRIPTION: An unspecified vulnerability in Java S...

Security Bulletin: Vulnerability in org.apache.mina_mina-core affects IBM Db2 Data Management Console(CVE-2024-52046)

Summary org.apache.minamina-core dependency package is used by IBM Db2 Data Management Console . This bulletin describes the upgrades necessary to address the vulnerability. Vulnerability Details CVEID:CVE-2024-52046 DESCRIPTION: The ObjectSerializationDecoder in Apache MINA uses Java’s native...

Security Bulletin: Vulnerability in com.google.protobuf_protobuf-java affects IBM Db2 Data Management Console (CVE-2024-7254)

Summary com.google.protobufprotobuf-java dependency package is used by IBM Db2 Data Management Console . This bulletin describes the upgrades necessary to address the vulnerability. Vulnerability Details CVEID:CVE-2024-7254 DESCRIPTION: Any project that parses untrusted Protocol Buffers data...

Security Bulletin: Multiple vulnerabilities that affects IBM Db2 Data Management Console (CVE-2021-3121, CVE-2021-38561, CVE-2023-43804)

Summary github.com/gogo/protobuf, golang.org/x/text, urllib3 are dependency packages used by IBM Db2 Data Management Console . This bulletin describes the upgrades necessary to address the vulnerability. Vulnerability Details CVEID:CVE-2023-43804 DESCRIPTION: urllib3 is a user-friendly HTTP clien...

CVE-2025-36117

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 does not disallow the session id after use which could allow an authenticated user to impersonate another user on the system...

CVE-2025-36117

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 does not disallow the session id after use which could allow an authenticated user to impersonate another user on the system...

CVE-2025-36116

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 GUI is affected by cross-site WebSocket hijacking vulnerability. By sending a specially crafted request, an unauthenticated malicious actor could exploit this vulnerability to sniff an existing WebSocket connection to then remotely perform operations that th...

Security Bulletin: IBM® Db2® is vulnerable to a denial of service under specific conditions (CVE-2024-52903)

Summary IBM® Db2® is vulnerable to a denial of service under specific conditions with a specially crafted query. Vulnerability Details CVEID:CVE-2024-52903 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server is vulnerable to a denial of service as the server may crash und...

Security Bulletin: IBM® Db2® is vulnerable to a denial of service under certain conditions. (CVE-2025-1493)

Summary IBM® Db2® is vulnerable to a denial of service due to concurrent execution of shared resources. Vulnerability Details CVEID:CVE-2025-1493 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server could allow an authenticated user to cause a denial of service due to...

Security Bulletin: IBM® Db2® is vulnerable to a denial of service when connecting to a z/OS database. (CVE-2025-1000)

Summary IBM® Db2® is vulnerable to a denial of service when connecting to a z/OS database due to improper handling of automatic client rerouting. Vulnerability Details CVEID:CVE-2025-1000 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server could allow an authenticated use...

Security Bulletin: IBM® Db2® is vulnerable to a denial of service due to insufficient release of allocated memory after usage. (CVE-2025-1992)

Summary IBM® Db2® is vulnerable to a denial of service due to insufficient release of allocated memory after usage under federation configuration. Vulnerability Details CVEID:CVE-2025-1992 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows includes DB2 Connect Server could allow an authenticated us...

Security Bulletin: IBM® Db2® federated server is vulnerable to a denial of service due to insufficient release of allocated memory resources. (CVE-2025-0915)

Summary IBM® Db2® is vulnerable to a denial of service due to insufficient release of allocated memory resources. Vulnerability Details CVEID:CVE-2025-0915 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server under specific configurations could allow an authenticated user ...

Security Bulletin: IBM® Db2® is vulnerable to denial of service as the server may crash under certain conditions with a specially crafted query on columnar tables (CVE-2024-49350)

Summary IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query on columnar tables. Vulnerability Details CVEID:CVE-2024-49350 DESCRIPTION: IBM Db2 for Linux, UNIX and...

Security Bulletin: IBM® Db2® is vulnerable to a denial of service as the server may crash under certain conditions (CVE-2025-2518).

Summary IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query. Vulnerability Details CVEID:CVE-2025-2518 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows includes Db2...

Security Bulletin: IBM® Db2® is affected by a vulnerability in the hadoop-common library (CVE-2024-23454).

Summary IBM® Db2® is vulnerable to an issue in Apache Hadoop which could allow a local authenticated attacker to access sensitive information. Vulnerability Details CVEID:CVE-2024-23454 DESCRIPTION: Apache Hadoop could allow a local authenticated attacker to obtain sensitive information, caused b...

Security Bulletin: IBM® Db2® federated server is vulnerable to unbounded recursions due to a vulnerability in protobuf-java (CVE-2024-7254).

Summary Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite...

Security Bulletin: IBM® Db2® is affected by a vulnerability in protobuf-java (CVE-2022-3510, CVE-2022-3509, CVE-2022-3171).

Summary protobuf-java core and lite are vulnerable to a denial of service, caused by a flaw in the parsing procedure for binary and text format data. By sending non-repeated embedded messages with repeated or unknown fields, a remote authenticated attacker could exploit this vulnerability to caus...

Security Bulletin: IBM® Db2® federated server is affected by a vulnerability in Apache Parquet (CVE-2025-30065).

Summary Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.15.1, which fixes the issue. Note: A Db2 server is not vulnerable to CVE-2025-30065 if the database manager...