Allocation of Resources Without Limits or Throttling in IBM DB2 LUW - CVE-2025-0915
Published: July 22, 2025
Vulnerability identifier: #VU113107
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-0915
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient release of allocated memory resources. A remote user can trigger resource exhaustion and perform a denial of service (DoS) attack.
Affected software
IBM DB2 LUW
IBM Cloud Pak System
Db2 Big SQL
IBM OpenPages with Watson
Storage Protect Server
IBM Cloud Application Performance Management (APM)
IBM Cloud Pak System
Db2 Big SQL
IBM OpenPages with Watson
Storage Protect Server
IBM Cloud Application Performance Management (APM)
How to mitigate CVE-2025-0915
Install updates from vendor's website.
Db2 Big SQL - update to 8.0
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.4
Storage Protect Server - update to 8.1.27.100
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.4
Storage Protect Server - update to 8.1.27.100
External References
Related Security Bulletins
- Allocation of resources without limits or throttling in IBM Db2 for Linux, UNIX and Windows
- Multiple vulnerabilities in IBM DB2 bundled with IBM Application Performance Management products
- Multiple vulnerabilities in IBM OpenPages
- Multiple vulnerabilities in IBM Cloud Pak System
- Multiple vulnerabilities in IBM Storage Protect Server
- Multiple vulnerabilities in IBM Big SQL on IBM Cloud Pak for Data