VYPR
← All advisories
High severity7.1NVD Advisory· Published Feb 17, 2026· Updated Jun 17, 2026

CVE-2025-36247

CVE-2025-36247

Description

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

5
  • IBM/Db25 versions
    cpe:2.3:a:ibm:db2:*:*:*:*:*:linux:*:*+ 4 more
    • cpe:2.3:a:ibm:db2:*:*:*:*:*:linux:*:*range: >=11.5.0,<=11.5.9
    • cpe:2.3:a:ibm:db2:*:*:*:*:*:unix:*:*range: >=11.5.0,<=11.5.9
    • cpe:2.3:a:ibm:db2:*:*:*:*:*:windows:*:*range: >=11.5.0,<=11.5.9
    • cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:linux:*:*range: 11.5.0
    • (no CPE)range: 11.5.0-11.5.9, 12.1.0-12.1.3

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.