Input validation error in IBM DB2 LUW - CVE-2025-13867
Published: February 12, 2026
Vulnerability identifier: #VU122747
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-13867
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to improper neutralization of special elements in data query logic. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
Affected software
IBM DB2 LUW
IBM Security Guardium Key Lifecycle Manager (GKLM)
WebSphere Remote Server
IBM Cloud Application Performance Management (APM)
IBM OpenPages with Watson
Db2 Big SQL
IBM Security Guardium Key Lifecycle Manager (GKLM)
WebSphere Remote Server
IBM Cloud Application Performance Management (APM)
IBM OpenPages with Watson
Db2 Big SQL
How to mitigate CVE-2025-13867
Install updates from vendor's website.
IBM OpenPages with Watson - update to 9.1.3
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.18
Db2 Big SQL - update to 8.3.1 patch 4
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.18
Db2 Big SQL - update to 8.3.1 patch 4
External References
Related Security Bulletins
- Improper Validation of Specified Quantity in Input in IBM Db2
- Input validation error in IBM DB2 LUW
- Input validation error in IBM DB2 LUW
- Multiple vulnerabilities in IBM WebSphere Remote Server
- Multiple vulnerabilities in IBM Guardium Key Lifecycle Manager
- Multiple vulnerabilities in IBM Cloud APM
- Multiple vulnerabilities in IBM OpenPages
- Multiple vulnerabilities in IBM Big SQL on Cloud Pak for Data