CVE-2025-14689
Denial of Service via Query Logic Flaw in IBM Db
Publication date: 2026-02-17
Last updated on: 2026-02-18
Assigner: IBM Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ibm | db2 | From 12.1.0 (inc) to 12.1.3 (inc) |
| ibm | db2 | From 12.1.0 (inc) to 12.1.3 (inc) |
| ibm | db2 | From 12.1.0 (inc) to 12.1.3 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1284 | The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
IBM has withheld detailed replication steps and key Db2 functionality information to prevent exploitation by malicious actors.
No specific detection commands or methods are provided in the available information.
Can you explain this vulnerability to me?
This vulnerability affects IBM Db2 federated server versions 12.1.0 through 12.1.3 on Unix platforms. It arises from improper neutralization of special elements in data query logic when queries involve federated objects. An authenticated user can exploit this flaw to cause a denial of service (DoS) condition, disrupting the availability of the database service.
How can this vulnerability impact me? :
The primary impact of this vulnerability is a denial of service (DoS) attack, which can make the IBM Db2 database service unavailable. Although it does not affect confidentiality or integrity of data, the high impact on availability means that users and applications relying on the database could experience service interruptions or outages.
What immediate steps should I take to mitigate this vulnerability?
Apply the special interim fix builds released by IBM to remediate the issue on affected versions.
- For version 12.1.2, apply Special Build #72296 or later.
- For version 12.1.3, apply Special Build #74153 or later.
These fixes can be downloaded from IBM Fix Central and are identified by APAR DT457502.
No other workarounds or mitigations are available.