Medium severity · published Feb 17, 2026
CVE-2025-27901
Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and Windows
6.5
CVSS
0.2%
EPSS
No
On KEV
Description
IBM DB2 Recovery Expert for LUW 5.5 Interim Fix 002 IBM Db2 Recovery Expert for Linux, UNIX and Windows is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DR
DB2 Recovery Expert for LUW · IBM
5.5 Interim Fix 002 · source: vendor
DR
Db2 Recovery Expert · Ibm
5.5.0; 5.5.0; 5.5.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-27901
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-27901
Vendor Advisory
https://www.ibm.com/support/pages/node/7259901
More from DB2 Recovery Expert for LUW
6.5
CVE-2025-27904
Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and Windows
6.3
CVE-2025-27898
Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and Windows
6.1
CVE-2025-27900
Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and Windows
5.9
CVE-2025-27903
Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and Windows
5.3
CVE-2025-27899
Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and Windows