EUVD-2026-40393
GHSA-v7fg-h2r7-7537
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable DB query path requires only low-privilege credentials (PR:L); impact is pure availability loss with no confidentiality or integrity exposure.
Primary rating from Vendor (us).
CVSS VectorVendor: us
Lifecycle Timeline
2DescriptionCVE.org
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in the data query logic of XMLTable-derived columns.
AnalysisAI
Denial of service in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.4 allows an authenticated low-privileged user to crash or hang the database server by submitting a crafted SQL query exploiting improper neutralization of special elements in XMLTable-derived column processing logic. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms this is remotely triggerable with minimal privileges, posing a realistic insider-threat or compromised-credential availability risk. No public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
IBM Db2 implements the SQL/XML standard function XMLTable, which maps XML document content to relational rows and columns via XQuery path expressions - the 'derived columns' refer to those relational projections produced by XMLTable. CWE-1284 (Improper Validation of Specified Quantity in Input) identifies the root cause class: the Db2 XML query engine fails to properly neutralize or bound special elements embedded in the data-query logic of these derived column expressions, allowing crafted input to trigger undefined or fatal behavior in the engine. The flaw spans all major IBM Db2 platforms (Linux, UNIX, Windows) and includes Db2 Connect Server deployments. The affected version matrix - 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 - covers current long-term and recent release branches, suggesting a defect in shared XML parsing infrastructure rather than a version-specific regression.
RemediationAI
Consult IBM advisory 7277423 at https://www.ibm.com/support/pages/node/7277423 for the applicable fix pack or iFix addressing CVE-2026-11906; exact patched version numbers were not independently confirmed from the reference data available, so the advisory is the authoritative source. If immediate patching is not feasible, reduce exposure by auditing and tightening database account privileges - revoke XMLTable query execution rights from accounts that do not require XML relational mapping functionality, as this prevents a low-privileged user from reaching the vulnerable code path. Additionally, consider restricting network-level access to the Db2 listener port to known application servers rather than broad internal networks, reducing the pool of potential attackers. Note that restricting XMLTable access may break XML-processing application features and should be validated in a staging environment before production enforcement.
Stack-based buffer overflow in the SQL/PSM (aka SQL Persistent Stored Module) Stored Procedure (SP) infrastructure in IB
IBM DB2 for Linux, UNIX and Windows 9.2, 10.1, 10.5, and 11.1 (includes DB2 Connect Server) is vulnerable to a stack-bas
Stack-based buffer overflow in IBM DB2 9.7 through FP9a, 9.8 through FP5, 10.1 through FP4, and 10.5 before FP4 on Linux
IBM DB2 9.5 uses world-writable permissions for nodes.reg, which has unspecified impact and attack vectors. Rated critic
Remote code execution in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.4 lets unauthenticated network attackers run arbitrary co
Privilege escalation in IBM Db2 (data server versions 11.5.0-11.5.9 and 12.1.0-12.1.5) allows an attacker to submit a sp
Memory-corruption in IBM Db2's IXF file IMPORT parser lets an attacker supply a crafted IXF data file that overflows a s
Stack-based buffer overflow in the Java Stored Procedure infrastructure in IBM DB2 9.1 before FP12, 9.5 through FP9, 9.7
Directory traversal vulnerability in the UTL_FILE module in IBM DB2 and DB2 Connect 10.1 before FP1 on Windows allows re
IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) duplicates the PRNG state across fork() system
Integer signedness error in the db2dasrrm process in the DB2 Administration Server (DAS) in IBM DB2 9.1 through FP11, 9.
The Stored Procedure infrastructure in IBM DB2 9.5, 9.7 before FP9a, 10.1 before FP3a, and 10.5 before FP3a on Windows a
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today