CVE-2023-36728: Microsoft SQL Server Denial of Service Vulnerability

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-10-10 · updated 2026-06-17
Weakness: CWE-125

Description

Microsoft SQL Server Denial of Service Vulnerability

Affected products

Microsoft Odbc Driver For Sql Server: from 17.0 before 17.10.5.1; from 18.0 before 18.3.2.1 — fixed in 17.10.5.1, 18.3.2.1
Microsoft Ole Db Driver For Sql Server: from 18.0 before 18.6.0007.0; from 19.0 before 19.3.0002.0 — fixed in 18.6.0007.0, 19.3.0002.0
Microsoft SQL Server: 2014-sp3, 2016-sp3, 2017, 2019, 2022
Microsoft ODBC Driver 17 for SQL Server on Linux: from 17.0.0.0 before 17.10.5.1 — fixed in 17.10.5.1
Microsoft ODBC Driver 17 for SQL Server on MacOS: from 17.0.0.0 before 17.10.5.1 — fixed in 17.10.5.1
Microsoft ODBC Driver 17 for SQL Server on Windows: from 17.0.0.0 before 17.10.5.1 — fixed in 17.10.5.1
Microsoft ODBC Driver 18 for SQL Server on Linux: from 18.0.0.0 before 18.3.2.1 — fixed in 18.3.2.1
Microsoft ODBC Driver 18 for SQL Server on MacOS: from 18.0.0.0 before 18.3.2.1 — fixed in 18.3.2.1
Microsoft ODBC Driver 18 for SQL Server on Windows: from 18.0.0.0 before 18.3.2.1 — fixed in 18.3.2.1
Microsoft OLE DB Driver 18 for SQL Server: from 18.0.0 before 18.6.0007.0 — fixed in 18.6.0007.0
Microsoft OLE DB Driver 19 for SQL Server: from 19.0.0 before 19.3.0002.0 — fixed in 19.3.0002.0
Microsoft SQL Server 2014 Service Pack 3 (CU 4): from 12.0.0 before 12.0.6449.1 — fixed in 12.0.6449.1
Microsoft SQL Server 2014 Service Pack 3 (GDR): from 12.0.0 before 12.0.6179.1 — fixed in 12.0.6179.1
Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack: from 13.0.0 before 13.0.7029.3 — fixed in 13.0.7029.3
Microsoft SQL Server 2016 Service Pack 3 (GDR): from 13.0.0 before 13.0.6435.1 — fixed in 13.0.6435.1
Microsoft SQL Server 2017 (CU 31): from 14.0.0 before 14.0.3465.1 — fixed in 14.0.3465.1
Microsoft SQL Server 2017 (GDR): from 14.0.0 before 14.0.2052.1 — fixed in 14.0.2052.1
Microsoft SQL Server 2019 (CU 22): from 15.0.0 before 15.0.4326.1 — fixed in 15.0.4326.1
Microsoft SQL Server 2019 (GDR): from 15.0.0 before 15.0.2104.1 — fixed in 15.0.2104.1
Microsoft SQL Server 2022 (CU 8): from 15.0.0 before 16.0.4080.1 — fixed in 16.0.4080.1
Microsoft SQL Server 2022 (GDR): from 16.0.0 before 16.0.1105.1 — fixed in 16.0.1105.1

How to fix

Upgrade to a fixed version: Microsoft Odbc Driver For Sql Server 17.10.5.1, 18.3.2.1; Microsoft Ole Db Driver For Sql Server 18.6.0007.0, 19.3.0002.0; Microsoft ODBC Driver 17 for SQL Server on Linux 17.10.5.1; Microsoft ODBC Driver 17 for SQL Server on MacOS 17.10.5.1; Microsoft ODBC Driver 17 for SQL Server on Windows 17.10.5.1; Microsoft ODBC Driver 18 for SQL Server on Linux 18.3.2.1; Microsoft ODBC Driver 18 for SQL Server on MacOS 18.3.2.1; Microsoft ODBC Driver 18 for SQL Server on Windows 18.3.2.1; Microsoft OLE DB Driver 18 for SQL Server 18.6.0007.0; Microsoft OLE DB Driver 19 for SQL Server 19.3.0002.0; Microsoft SQL Server 2014 Service Pack 3 (CU 4) 12.0.6449.1; Microsoft SQL Server 2014 Service Pack 3 (GDR) 12.0.6179.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-36728 or the next vulnerability affects your stack