XML External Entity Injection Vulnerability in IBM Db2

CVE-2025-36247

What is CVE-2025-36247?

IBM Db2 for Linux, UNIX and Windows (including Db2 Connect Server) versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 are vulnerable to an XML External Entity (XXE) injection attack during the processing of XML data. This vulnerability allows a remote attacker to exploit the application, potentially leading to the exposure of sensitive information, unauthorized access, and increased consumption of memory resources. Organizations using these versions are strongly advised to apply the available patches to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References