EUVD-2026-32488
GHSA-xfpq-g5f8-6gqr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Db2 query access
-
ExploitCraft query abusing small statement heap
-
ImpactExhaust resources and crash database
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to execute a specially crafted SQL query against the Db2 engine while it is operating with a small statement heap (STMTHEAP) configuration - the limiting precondition is both the ability to submit queries to the database and a constrained statement-heap setting that allows the crafted query to exhaust resources. Only availability is affected (no data exposure or modification). The primary limiting factor is access to issue queries: although the CVSS vector claims PR:N, running arbitrary SQL against Db2 typically requires an authenticated database session, so realistic exploitation is likely gated by at least low-privilege database credentials. Affected deployments are IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.4; authentication requirements are not fully confirmed from available data and should be verified with IBM. |
| Impact | This is a moderate-priority availability issue, not an urgent one. The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a pure denial-of-service impact (C:N/I:N) with no confidentiality or integrity consequence, so the headline 'High' severity is driven entirely by availability. The real-world exploitation signals are uniformly low: EPSS is 0.01% (2nd percentile), there is no CISA KEV listing, and CISA's SSVC decision framework rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial'. No public proof-of-concept is referenced. A notable conflict exists between the CVSS vector and the description: the vector asserts PR:N (unauthenticated), but the described action - 'executing a specially crafted query' against a Db2 database - ordinarily requires an authenticated database session, which would make this PR:L in practice. Verify the actual pre-authentication reachability with IBM before treating this as an unauthenticated network DoS. Net assessment: a genuine but low-urgency DoS affecting availability only, worth patching on a normal maintenance cycle rather than emergency timelines. |
| Exploit ScenarioDerived | An attacker with the ability to submit SQL to an affected IBM Db2 instance crafts a query designed to abuse a small statement heap configuration, triggering uncontrolled resource consumption (CWE-400) that crashes or hangs the database and denies service to legitimate users. No public exploit code is identified at the time of analysis, and the low attack complexity (AC:L) means a single malformed query can reliably reproduce the condition once database access is obtained. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 14, 2026
Denial of service in IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 allows a user who can submit SQL to exhaust the statement heap with a specially crafted query while the engine is running with a small statement-heap configuration, degrading or halting availability for all sessions on the instance. This is a moderate-priority availability issue, not an urgent one: no public exploit was identified at time of analysis, EPSS is 0.01% (2nd percentile), CISA SSVC records an exploitation value of none with automatable set to no, and only availability is impacted (no confidentiality or integrity loss). The published NVD vector scores PR:N, but our assessment treats realistic exploitation as gated by at least a low-privilege database session (PR:L), and authentication requirements are not fully confirmed from available data and should be verified with IBM.
Earlier versions of this analysis (1)
Denial of service in IBM Db2 versions 11.5.0-11.5.9 and 12.1.0-12.1.4 allows a locally authenticated, low-privileged user to crash the database service by executing a specially crafted SQL query against an instance configured with a small statement heap. The vulnerability stems from uncontrolled resource consumption (CWE-400) during query processing, resulting in high availability impact with no confidentiality or integrity exposure. No public exploit code and no active exploitation have been identified at time of analysis; SSVC classifies exploitation status as none.
RemediationAI
No vendor-released patch version is identified in the available data at time of analysis; consult the IBM advisory at https://www.ibm.com/support/pages/node/7273558 for the current fix release and interim guidance, and check the VulDB entry https://vuldb.com/vuln/366354 for corroborating detail. As a compensating control, raise the statement heap (STMTHEAP) database configuration parameter so crafted compilation requests cannot exhaust it - the trade-off is increased per-connection memory consumption, which must be sized against available instance memory. Restrict the ability to submit ad-hoc SQL to trusted accounts and, where applicable, use workload/query governance or resource limits to cap compilation costs of untrusted queries; these reduce exposure but do not eliminate the underlying defect and may reject or slow legitimate complex queries. Because authentication requirements are not fully confirmed from available data, verify with IBM whether an unauthenticated path exists before assuming perimeter controls are sufficient.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an uncontrolled resource consumption condition (CWE-400) in the IBM Db2 engine's SQL compilation path. Db2 allocates statement heap (STMTHEAP) memory to hold parsed and optimized representations of SQL statements during compilation; when that heap is configured small, a query crafted to consume disproportionate compilation memory can exhaust the allocation and trigger a denial-of-service condition affecting the database instance. The affected CPEs are cpe:2.3:a:ibm:db2 for the 11.5 and 12.1 release lines, consistent with the vendor-listed ranges DB2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 (EUVD-2026-32488). Scope is unchanged (S:U) with high availability impact only (C:N/I:N/A:H), so the damage is service disruption rather than data compromise; exploitation requires both query submission capability and the constrained statement-heap precondition, which narrows practical exposure.
Know when Db2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Executing a query against Db2 normally requires an authenticated session, so PR:L rather than PR:N; low complexity, availability-only impact, no scope change.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a denial of service when executing a specially crafted query with a small statement heap.
Executive ViewAI
A high-severity availability flaw in IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 could let a database user exhaust the statement heap with a crafted query, degrading or stalling every session on the affected instance. Because affected systems host shared workloads, a single misbehaving or malicious query could disrupt application availability for business users until the instance is recovered. There is currently no vendor-released patch, no public exploit identified at time of analysis, and the practical risk is concentrated in environments running small statement-heap settings.
No vendor-released patch identified at time of analysis. Interim mitigations: increase the statement-heap configuration so normal SQL cannot exhaust it, strictly limit which accounts may submit SQL (exploitation is assessed as gated by at least a low-privilege database session, though the published NVD vector scores PR:N and this should be verified with IBM), enforce resource-governance/workload limits per session, monitor statement-heap consumption and instance availability with alerting, and apply the vendor fix as soon as IBM releases it.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Stack-based buffer overflow in the SQL/PSM (aka SQL Persistent Stored Module) Stored Procedure (SP) infrastructure in IB
IBM DB2 for Linux, UNIX and Windows 9.2, 10.1, 10.5, and 11.1 (includes DB2 Connect Server) is vulnerable to a stack-bas
Stack-based buffer overflow in IBM DB2 9.7 through FP9a, 9.8 through FP5, 10.1 through FP4, and 10.5 before FP4 on Linux
IBM DB2 9.5 uses world-writable permissions for nodes.reg, which has unspecified impact and attack vectors. Rated critic
Remote code execution in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.4 lets unauthenticated network attackers run arbitrary co
Privilege escalation in IBM Db2 (data server versions 11.5.0-11.5.9 and 12.1.0-12.1.5) allows an attacker to submit a sp
Memory-corruption in IBM Db2's IXF file IMPORT parser lets an attacker supply a crafted IXF data file that overflows a s
Stack-based buffer overflow in the Java Stored Procedure infrastructure in IBM DB2 9.1 before FP12, 9.5 through FP9, 9.7
Directory traversal vulnerability in the UTL_FILE module in IBM DB2 and DB2 Connect 10.1 before FP1 on Windows allows re
IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) duplicates the PRNG state across fork() system
Integer signedness error in the db2dasrrm process in the DB2 Administration Server (DAS) in IBM DB2 9.1 through FP11, 9.
The Stored Procedure infrastructure in IBM DB2 9.5, 9.7 before FP9a, 10.1 before FP3a, and 10.5 before FP3a on Windows a
Exploit-DB