Allocation of Resources Without Limits or Throttling in IBM DB2 LUW - CVE-2025-1000

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU113110

Allocation of Resources Without Limits or Throttling in IBM DB2 LUW - CVE-2025-1000

Published: July 22, 2025


Vulnerability identifier: #VU113110
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-1000
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper handling of automatic client rerouting when connecting to a z/OS database. A remote user can trigger resource exhaustion and perform a denial of service (DoS) attack.


Affected software

IBM DB2 LUW
IBM Cloud Pak System
Db2 Big SQL
IBM OpenPages with Watson
Storage Protect Server
IBM Cloud Application Performance Management (APM)

How to mitigate CVE-2025-1000

Install updates from vendor's website.

Db2 Big SQL - update to 8.0
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.4
Storage Protect Server - update to 8.1.27.100

External References

Related Security Bulletins