CVE-2020-4135

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow an unauthenticated user to send specially crafted packets to cause a denial of service from excessive memory usage.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected software

Vendor	Product	Versions
IBM	DB2 for Linux- UNIX and Windows	9.7; 10.1; 10.5; 11.1; 11.5

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/173806VDB Entry, Vendor Advisory
https://security.netapp.com/advisory/ntap-20210108-0001/Third Party Advisory
https://www.ibm.com/support/pages/node/2876307Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/173806VDB Entry, Vendor Advisory
https://security.netapp.com/advisory/ntap-20210108-0001/Third Party Advisory
https://www.ibm.com/support/pages/node/2876307Vendor Advisory

Timeline

Published: Feb 19, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-41385.5IBM SiteProtector Appliance 3.1.1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 174 CVE-2020-41405.4IBM Security SiteProtector System 3.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript CVE-2020-41465.3IBM Security SiteProtector System 3.1.1 could allow a remote attacker to obtain sensitive information, caused by missing 'HttpOnly' flag. A CVE-2020-41509.8IBM SiteProtector Appliance 3.1.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inboun CVE-2020-41516.5IBM QRadar SIEM 7.3.0 through 7.3.3 could allow an authenticated attacker to perform unauthorized actions due to improper input validation. CVE-2020-41525.9IBM QRadar Network Security 5.4.0 and 5.5.0 transmits sensitive or security-critical data in cleartext in a communication channel that can b CVE-2020-41535.4IBM QRadar Network Security 5.4.0 and 5.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaSc CVE-2020-41577.5IBM QRadar Network Security 5.4.0 and 5.5.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its CVE-2020-41597.5IBM QRadar Network Security 5.4.0 and 5.5.0 discloses sensitive information to unauthorized users which could be used to mount further attac CVE-2020-41605.9IBM QRadar Network Security 5.4.0 and 5.5.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly CVE-2020-41616.5IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 could allow an authenticated attacker to cause a denial of service du CVE-2020-41625.4IBM InfoSphere Information Server 11.5 and 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Ja