IBM Jazz Reporting Service Denial of Service

The primary impact of CVE-2025-1823 is a denial of service. A successful attacker can craft malicious SQL queries that consume significant memory resources within the Jazz Reporting Service. This can lead to the service becoming unresponsive, impacting users' ability to generate reports and access critical data. While the CVSS score is LOW, the disruption caused by a DoS attack can still be significant, especially in environments where the Jazz Reporting Service is crucial for business operations. The vulnerability requires authentication, limiting the immediate attack surface, but the potential for internal exploitation remains a concern.

Organizations utilizing IBM Jazz Reporting Service versions 7.0.3 through 7.1iFix006, particularly those with internal users who have authenticated access to the reporting service and the ability to execute SQL queries, are at risk. Shared hosting environments where multiple users share the same Jazz Reporting Service instance are also potentially vulnerable.

1. 2026-02-04Disclosure

   disclosure

1. Reserviert2025-03-01
2. Veröffentlicht2026-02-04
3. Geändert2026-02-05
4. EPSS aktualisiert2026-03-23

The recommended mitigation for CVE-2025-1823 is to upgrade to IBM Jazz Reporting Service version 7.1.1 or later, which contains the fix. If an immediate upgrade is not feasible, consider implementing temporary workarounds such as restricting access to the reporting service to trusted users and monitoring memory usage closely. While a direct WAF rule is unlikely to be effective against crafted SQL, limiting query complexity and input validation can reduce the risk. After upgrading, confirm the fix by attempting to execute the malicious SQL query and verifying that it no longer causes excessive memory consumption.