Resource exhaustion in Db2 for Linux - CVE-2025-2533
Published: August 18, 2025
Vulnerability identifier: #VU114148
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-2533
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
Affected software
Db2 for Linux
Watson Query on Cloud Pak for Data
Data Virtualization (DV) on Cloud Pak for Data (CPD)
Db2 Big SQL
IBM OpenPages with Watson
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Security Verify Governance
Watson Query on Cloud Pak for Data
Data Virtualization (DV) on Cloud Pak for Data (CPD)
Db2 Big SQL
IBM OpenPages with Watson
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Security Verify Governance
How to mitigate CVE-2025-2533
Install updates from vendor's website.
Data Virtualization (DV) on Cloud Pak for Data (CPD) - update to 3.2.1
Db2 Big SQL - update to 8.1
IBM OpenPages with Watson - update to 9.1.2
Db2 Big SQL - update to 8.1
IBM OpenPages with Watson - update to 9.1.2
External References
Related Security Bulletins
- Resource exhaustion in IBM Db2 for Linux
- Multiple vulnerabilities in IBM Security Guardium Key Lifecycle Manager
- Multiple vulnerabilities in IBM Data Virtualization on IBM Software Hub
- Multiple vulnerabilities in IBM Security Verify Governance
- Multiple vulnerabilities in IBM OpenPages
- Multiple vulnerabilities in IBM Big SQL on IBM Cloud Pak for Data