CVE-2025-36366

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-36366
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a user to cause a denial of service by executing a query that invokes the JSON_Object scalar function, which may trigger an unhandled exception leading to abnormal server termination.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.ibm.com/support/pages/node/7257681
Configurations

No configuration.

History

03 Feb 2026, 18:16

Type Values Removed Values Added
Summary (en) IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow a local user to cause a denial of service due to improper neutralization of special elements in data query logic. (en) IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a user to cause a denial of service by executing a query that invokes the JSON_Object scalar function, which may trigger an unhandled exception leading to abnormal server termination.
Information

Published : 2026-01-30 22:15

Updated : 2026-02-03 18:16

NVD link : CVE-2025-36366

Mitre link : CVE-2025-36366

CVE.ORG link : CVE-2025-36366

JSON object : View

Products Affected

No product.

CWE
CWE-943

Improper Neutralization of Special Elements in Data Query Logic