Deadlock in Db2 for Linux - CVE-2025-36010
Published: August 18, 2025
Vulnerability identifier: #VU114153
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-36010
CWE-ID: CWE-833
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to executable segments that are waiting for each other to release a necessary lock. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
Affected software
Db2 for Linux
Watson Query on Cloud Pak for Data
Data Virtualization (DV) on Cloud Pak for Data (CPD)
Db2 Big SQL
IBM OpenPages with Watson
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Security Verify Governance
Watson Query on Cloud Pak for Data
Data Virtualization (DV) on Cloud Pak for Data (CPD)
Db2 Big SQL
IBM OpenPages with Watson
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Security Verify Governance
How to mitigate CVE-2025-36010
Install updates from vendor's website.
Data Virtualization (DV) on Cloud Pak for Data (CPD) - update to 3.2.1
Db2 Big SQL - update to 8.1
IBM OpenPages with Watson - update to 9.1.2
Db2 Big SQL - update to 8.1
IBM OpenPages with Watson - update to 9.1.2
External References
Related Security Bulletins
- Deadlock in IBM Db2 for Linux
- Multiple vulnerabilities in IBM Security Guardium Key Lifecycle Manager
- Multiple vulnerabilities in IBM Data Virtualization on IBM Software Hub
- Multiple vulnerabilities in IBM Security Verify Governance
- Multiple vulnerabilities in IBM OpenPages
- Multiple vulnerabilities in IBM Big SQL on IBM Cloud Pak for Data