EUVD-2026-51249
GHSA-qp88-xvp7-g6v3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local access to Db2 host
-
DeliveryEstablish database session
-
ExploitSubmit crafted non-fenced federated query
-
ExecutionTrigger uncontrolled resource consumption in wrapper
-
PersistExhaust engine resources
-
ImpactDeny service to all Db2 clients
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local access to a host running IBM Db2 12.1.0 through 12.1.4 with the federated server feature enabled and at least one non-fenced wrapper configured. The specific trigger is executing a non-fenced federated query - environments with no federated data source configurations, or those using exclusively fenced wrappers, are not exposed. Although the vendor CVSS specifies PR:N, executing federated queries in practice requires a Db2 database session at minimum; whether OS-level local access alone is sufficient has not been independently confirmed. Remote exploitation is not possible given the AV:L vector. The attack is limited to availability; there is no confidentiality or integrity impact. |
| Impact | The vendor-supplied CVSS base score of 6.2 (Medium) with vector AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H reflects a local-access, low-complexity attack yielding high availability impact with no confidentiality or integrity exposure. The local attack vector (AV:L) is the most significant risk-reducing factor, ruling out remote unauthenticated exploitation. The PR:N designation warrants scrutiny: executing federated queries in practice typically requires at minimum a valid Db2 database session - vendor-supplied PR:N may reflect OS-level process access rather than absence of database authentication, and this has not been independently verified. No EPSS score was provided in the intelligence data; KEV status is negative; no public proof-of-concept exists. SSVC signals point to low urgency: exploitation is not confirmed or automated, the attack surface is local, and impact is limited to availability. Real-world priority is moderate for organizations running Db2 12.1.x in federated configurations, and low for those without federated data sources. |
| Exploit ScenarioDerived | A local user or process with a valid Db2 database session submits a crafted non-fenced federated query that triggers unbounded resource consumption in the in-process wrapper library. The Db2 engine exhausts available memory or threads and becomes unresponsive, causing a denial of service affecting all concurrent database clients. No public proof-of-concept has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Denial of service in IBM Db2 federated server (versions 12.1.0 through 12.1.4) can be triggered by executing non-fenced federated queries, causing the database engine to exhaust resources and become unresponsive. The root cause is CWE-400 (Uncontrolled Resource Consumption) within the in-process federated wrapper execution path. No public exploit has been identified at time of analysis, and IBM has released a patch via their support portal.
RemediationAI
IBM has released a patch for this vulnerability; apply the fix as documented in the IBM support advisory at https://www.ibm.com/support/pages/node/7279474. The exact patched version should be confirmed from that advisory before deployment. As an interim compensating control, administrators can migrate non-fenced federated wrappers to fenced mode, which isolates wrapper execution from the Db2 engine process and prevents a wrapper crash from taking down the database - the trade-off is a measurable performance overhead on federated query throughput. Alternatively, restricting which database roles may execute federated queries via GRANT/REVOKE narrows the blast radius but does not eliminate the vulnerability if the federated server remains reachable by any user.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM Db2's federated server capability allows the database engine to query heterogeneous remote data sources through pluggable wrapper libraries. 'Non-fenced' mode executes these wrappers in-process with the Db2 engine itself, as opposed to 'fenced' mode where wrappers run in a separate, isolated subprocess. CWE-400 (Uncontrolled Resource Consumption) indicates that a specially crafted or pathological non-fenced federated query can exhaust a finite resource - such as memory, threads, or file descriptors - without an upper bound, causing the engine to hang or crash. The affected CPE cpe:2.3:a:ibm:db2:*:*:*:*:*:*:*:* covers the IBM Db2 product line, with the vendor-confirmed affected range being 12.1.0 through 12.1.4.
Know when Db2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local vector confirmed; executing federated queries requires a database session (PR:L not PR:N); impact is availability-only per description.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
IBM Db2 12.1.0 through 12.1.4 federated server is vulnerable to a denial of service when running non fenced federated queries.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Stack-based buffer overflow in the SQL/PSM (aka SQL Persistent Stored Module) Stored Procedure (SP) infrastructure in IB
IBM DB2 for Linux, UNIX and Windows 9.2, 10.1, 10.5, and 11.1 (includes DB2 Connect Server) is vulnerable to a stack-bas
Stack-based buffer overflow in IBM DB2 9.7 through FP9a, 9.8 through FP5, 10.1 through FP4, and 10.5 before FP4 on Linux
IBM DB2 9.5 uses world-writable permissions for nodes.reg, which has unspecified impact and attack vectors. Rated critic
Remote code execution in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.4 lets unauthenticated network attackers run arbitrary co
Privilege escalation in IBM Db2 (data server versions 11.5.0-11.5.9 and 12.1.0-12.1.5) allows an attacker to submit a sp
Memory-corruption in IBM Db2's IXF file IMPORT parser lets an attacker supply a crafted IXF data file that overflows a s
Stack-based buffer overflow in the Java Stored Procedure infrastructure in IBM DB2 9.1 before FP12, 9.5 through FP9, 9.7
Directory traversal vulnerability in the UTL_FILE module in IBM DB2 and DB2 Connect 10.1 before FP1 on Windows allows re
IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) duplicates the PRNG state across fork() system
Integer signedness error in the db2dasrrm process in the DB2 Administration Server (DAS) in IBM DB2 9.1 through FP11, 9.
The Stored Procedure infrastructure in IBM DB2 9.5, 9.7 before FP9a, 10.1 before FP3a, and 10.5 before FP3a on Windows a
Exploit-DB