CVE-2025-27901

CWE-6443 documents3 sources
Severity
6.5MEDIUM
EPSS
0.1%
top 84.69%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
IBM DB2 Recovery Expert FOR LUWIBM DB2 Recovery Expert
Timeline
PublishedFeb 17

Description

IBM DB2 Recovery Expert for LUW 5.5 Interim Fix 002 IBM Db2 Recovery Expert for Linux, UNIX and Windows is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NExploitability: 3.9 | Impact: 2.5

Affected Packages2 packages

▶CVEListV5ibm/db2_recovery_expert_for_luw5.5 Interim Fix 002

🔴Vulnerability Details

2
GHSA
GHSA-wrqj-g5w9-qq86: IBM DB2 Recovery Expert for LUW 5↗2026-02-17
▶
CVEList
Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and Windows↗2026-02-17
▶
CVE-2025-27901 (MEDIUM CVSS 6.5) | IBM DB2 Recovery Expert for LUW 5.5 | cvebase.io