CVE-20XX-?

IBM db2 CVEs.

Published CVEs affecting IBM db2, ranked by exploit odds.

76 CVEs · updated 2026-11-06 05:35 UTC

  1. CVE-2026-10109

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution due to improper pre-auth DRDA handshake handling.

    Injection Server IBM db2

    9.8 CRITICAL 0.9% exploit odds Fix listed
  2. CVE-2025-36184

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 could allow an instance owner to execute malicious code that escalate their privileges to root due to execution of unnecessary privileges operated at a higher than minimum level.

    Other OS & kernel IBM db2

    7.2 HIGH 0.5% exploit odds Fix listed
  3. CVE-2026-86093

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute arbitrary commands on Db2 clients due to a stack-based buffer overflow that improperly copies user-controlled data into a fixed-size stack buffer without bounds checking.

    Memory safety Server IBM db2

    7.5 HIGH 0.5% exploit odds Fix listed
  4. CVE-2025-36442

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query with XML columns.

    Denial of service OS & kernel IBM db2

    6.5 MEDIUM 0.4% exploit odds Fix listed
  5. CVE-2024-49350

    IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.

    IBM db2

    6.5 MEDIUM 0.4% exploit odds Fix listed
  6. CVE-2024-54178

    IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8,5.0,5.1,5.2,5.3 could allow an authenticated user to cause a denial of service when creating new databases due to improper allocation of resources.

    Denial of service IBM db2

    6.5 MEDIUM 0.4% exploit odds Fix listed
  7. CVE-2026-11906

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in the data query logic of XMLTable-derived columns.

    Denial of service Server IBM db2

    6.5 MEDIUM 0.4% exploit odds Fix listed
  8. CVE-2025-0915

    IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 under specific configurations could allow an authenticated user to cause a denial of service due to insufficient release of allocated memory resources.

    IBM db2

    5.3 MEDIUM 0.4% exploit odds Fix listed
  9. CVE-2025-3050

    IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 could allow an authenticated user to cause a denial of service when using Q replication due to the improper allocation of CPU resources.

    IBM db2

    5.3 MEDIUM 0.4% exploit odds Fix listed
  10. CVE-2025-36366

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a user to cause a denial of service by executing a query that invokes the JSON_Object scalar function, which may trigger an unhandled exception leading to abnormal server termination.

    Denial of service OS & kernel IBM db2

    6.5 MEDIUM 0.4% exploit odds Fix listed
  11. CVE-2025-1000

    IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 could allow an authenticated user to cause a denial of service when connecting to a z/OS database due to improper handling of automatic client rerouting.

    IBM db2

    5.3 MEDIUM 0.4% exploit odds Fix listed
  12. CVE-2026-10543

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation with a specially crafted query.

    Auth & access IBM db2

    8.2 HIGH 0.4% exploit odds Fix listed
  13. CVE-2025-36070

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 is vulnerable to a denial of service as a trap may occur when selecting from certain types of tables.

    Denial of service OS & kernel IBM db2

    6.5 MEDIUM 0.4% exploit odds Fix listed
  14. CVE-2025-1992

    IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 could allow an authenticated user in federation environment, to cause a denial of service due to insufficient release of allocated memory after usage.

    IBM db2

    5.3 MEDIUM 0.4% exploit odds Fix listed
  15. CVE-2025-36098

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of service due to improper allocation of resources.

    Denial of service OS & kernel IBM db2

    6.5 MEDIUM 0.4% exploit odds Fix listed
  16. CVE-2025-2668

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 is vulnerable to a denial of service as the server may crash when an authenticated user creates a specially crafted query.

    Denial of service OS & kernel IBM db2

    6.5 MEDIUM 0.4% exploit odds Fix listed
  17. CVE-2025-36001

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of service using a specially crafted SQL statement including XML that performs uncontrolled recursion.

    Denial of service OS & kernel IBM db2

    6.5 MEDIUM 0.4% exploit odds Fix listed
  18. CVE-2025-36009

    IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow an authenticated user to cause a denial of service due to excessive use of a global variable.

    Denial of service OS & kernel IBM db2

    6.5 MEDIUM 0.4% exploit odds No fix listed
  19. CVE-2026-87958

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by a privileged user under certain conditions.

    Auth & access Server IBM db2

    8.1 HIGH 0.4% exploit odds Fix listed
  20. CVE-2025-1493

    IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 12.1.0 through 12.1.1 could allow an authenticated user to cause a denial of service due to concurrent execution of shared resources.

    IBM db2

    5.3 MEDIUM 0.4% exploit odds Fix listed
  21. CVE-2026-10534

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to buffer overflow in the IXF IMPORT parser.

    Memory safety Library IBM db2

    8.4 HIGH 0.4% exploit odds Fix listed
  22. CVE-2025-36387

    IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 - 11.5.9 could allow an authenticated user to cause a denial of service when given specially crafted query.

    Denial of service OS & kernel IBM db2

    6.5 MEDIUM 0.4% exploit odds Fix listed
  23. CVE-2025-36424

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a user to cause a denial of service due to improper neutralization of special elements in data query logic.

    Denial of service OS & kernel IBM db2

    6.5 MEDIUM 0.4% exploit odds Fix listed
  24. CVE-2025-36427

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a user to cause a denial of service due to insufficient validation of special elements in data query logic.

    Denial of service OS & kernel IBM db2

    6.5 MEDIUM 0.4% exploit odds Fix listed
  25. CVE-2024-51473

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5.0.0 through 10.5.0.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.2 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.

    Memory safety OS & kernel IBM db2

    6.5 MEDIUM 0.4% exploit odds Fix listed
  26. CVE-2026-1718

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a denial of service with a specially crafted query when autonomous transactions are enabled.

    Denial of service IBM db2

    7.1 HIGH 0.4% exploit odds Fix listed
  27. CVE-2024-52903

    IBM Db2 for Linux, UNIX and Windows 12.1.0 and 12.1.1 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.

    IBM db2

    5.3 MEDIUM 0.4% exploit odds Fix listed
  28. CVE-2025-33114

    IBM Db2 for Linux 12.1.0, 12.1.1, and 12.1.2 is vulnerable to denial of service with a specially crafted query under certain non-default conditions.

    Denial of service IBM db2

    5.3 MEDIUM 0.4% exploit odds Fix listed
  29. CVE-2025-2533

    IBM Db2 for Linux 12.1.0, 12.1.1, and 12.1.2 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.

    Denial of service Server IBM db2

    5.3 MEDIUM 0.4% exploit odds Fix listed
  30. CVE-2025-2518

    IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.

    IBM db2

    5.3 MEDIUM 0.4% exploit odds Fix listed
  31. CVE-2024-52894

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5.0.0 through 10.5.0.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.2 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.

    Memory safety OS & kernel IBM db2

    4.9 MEDIUM 0.4% exploit odds Fix listed
  32. CVE-2024-49828

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5.0.0 through 10.5.0.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.2 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.

    Memory safety OS & kernel IBM db2

    6.5 MEDIUM 0.3% exploit odds Fix listed
  33. CVE-2025-36071

    IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.2 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query due to improper release of memory resources.

    Denial of service OS & kernel IBM db2

    6.5 MEDIUM 0.3% exploit odds Fix listed
  34. CVE-2025-36247

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

    Other OS & kernel IBM db2

    7.1 HIGH 0.3% exploit odds Fix listed
  35. CVE-2025-2669

    IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8, 5.0, 5.1, 5.2, 5.3 could allow a privileged user to perform operations and obtain sensitive information outside of their authority due to improper token validation.

    Crypto IBM db2

    6.0 MEDIUM 0.3% exploit odds Fix listed
  36. CVE-2026-86087

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an authenticated user to send a specially crafted request to write arbitrary files on the system.

    Disclosure IBM db2

    4.3 MEDIUM 0.3% exploit odds Fix listed
  37. CVE-2025-36428

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in data query logic when the RPSCAN feature is enabled.

    Denial of service OS & kernel IBM db2

    5.3 MEDIUM 0.3% exploit odds Fix listed
  38. CVE-2026-16480

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is affected by an improper authorization vulnerability in the certain command, allowing a non-privileged user to bypass authority checks and modify database catalog data.

    Other Server IBM db2

    4.3 MEDIUM 0.3% exploit odds Fix listed
  39. CVE-2026-1577

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in data query logic.

    Denial of service Server IBM db2

    6.5 MEDIUM 0.3% exploit odds Fix listed
  40. CVE-2026-1352

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in data query logic.

    Denial of service OS & kernel IBM db2

    6.5 MEDIUM 0.3% exploit odds Fix listed
  41. CVE-2024-47118

    IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.

    Memory safety OS & kernel IBM db2

    6.5 MEDIUM 0.3% exploit odds Fix listed
  42. CVE-2025-36006

    IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial due to the improper release of resources after use.

    Other OS & kernel IBM db2

    6.5 MEDIUM 0.3% exploit odds Fix listed
  43. CVE-2025-36008

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial of service due to improper allocation of resources.

    Denial of service OS & kernel IBM db2

    6.5 MEDIUM 0.3% exploit odds Fix listed
  44. CVE-2025-36407

    IBM® Db2® is vulnerable to a denial of service with a specially crafted query that uses ALTER TABLE operations.

    Denial of service IBM db2

    6.5 MEDIUM 0.3% exploit odds Fix listed
  45. CVE-2025-36372

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 Connect Server) could disclose sensitive information to an authenticated user from the monitoring and event tables.

    Disclosure Server IBM db2

    5.5 MEDIUM 0.3% exploit odds Fix listed
  46. CVE-2025-2534

    IBM Db2 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.

    Denial of service OS & kernel IBM db2

    5.3 MEDIUM 0.3% exploit odds Fix listed
  47. CVE-2025-36365

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 under specific configuration of cataloged remote storage aliases could allow an authenticated user to execute unauthorized commands due to an authorization bypass vulnerability using a user-controlled key.

    Auth & access OS & kernel IBM db2

    6.8 MEDIUM 0.3% exploit odds Fix listed
  48. CVE-2025-36010

    IBM Db2 for Linux 12.1.0, 12.1.1, and 12.1.2 could allow an unauthenticated user to cause a denial of service due to executable segments that are waiting for each other to release a necessary lock.

    Denial of service IBM db2

    6.5 MEDIUM 0.3% exploit odds Fix listed
  49. CVE-2025-14689

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 12.1.0 through 12.1.3 could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in data query logic with federated objects.

    Denial of service OS & kernel IBM db2

    6.5 MEDIUM 0.3% exploit odds Fix listed
  50. CVE-2025-13867

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in data query logic

    Denial of service OS & kernel IBM db2

    6.5 MEDIUM 0.3% exploit odds Fix listed

All CVEs affecting IBM db2 that appear in CVE.org and NVD, sorted by how likely they are to be exploited (EPSS), with fix status and timeline.