CVE-2025-1992: IBM Db2 denial of service

Q: What is the severity of CVE-2025-1992?

CVE-2025-1992 has been classified as a medium severity vulnerability due to its potential to cause a denial of service.

Q: How do I fix CVE-2025-1992?

To mitigate CVE-2025-1992, ensure that your IBM Db2 version is updated to a version that is not affected by this vulnerability.

Q: Who is affected by CVE-2025-1992?

CVE-2025-1992 affects authenticated users of IBM Db2 for Linux, UNIX, and Windows versions 11.5.0 to 11.5.9 and 12.1.0 to 12.1.1 under non-default configurations.

Q: What type of vulnerability is CVE-2025-1992?

CVE-2025-1992 is a resource management vulnerability that can lead to a denial of service due to insufficient memory release.

Q: What version of IBM Db2 is vulnerable to CVE-2025-1992?

Versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 of IBM Db2 are vulnerable to CVE-2025-1992.

Published May 5, 2025

Updated

IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 could allow an authenticated user in federation environment, to cause a denial of service due to insufficient release of allocated memory after usage.

Affected Software

9 affected components

IBM DB2>=11.5.0<=11.5.9, >=12.1.0<=12.1.1

IBM IBM® Db2®<=11.5.0 - 11.5.9

IBM IBM® Db2®<=12.1.0 - 12.1.1

All of the following

Any of the following

IBM DB2>=11.5.0<=11.5.9

IBM DB2=12.1.0

IBM DB2=12.1.1

Any of the following

Linux Linux kernel

Microsoft Windows

Opengroup Unix

Remediation

Information

Customers running any vulnerable affected level of an affected Program, V11.5 and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V11.5.9 and V12.1.1. They can be applied to any affected level of the appropriate release to remediate this vulnerability.

Event History

May 5, 2025

CVE Published

via IBM·12:00 AM

CVE Published

via MITRE·04:54 PM

Data Sourced

via MITRE·04:54 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·05:18 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-1992?

CVE-2025-1992 has been classified as a medium severity vulnerability due to its potential to cause a denial of service.

How do I fix CVE-2025-1992?

To mitigate CVE-2025-1992, ensure that your IBM Db2 version is updated to a version that is not affected by this vulnerability.

Who is affected by CVE-2025-1992?