Db2
Monthly
Authenticated users of IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (including DB2 Connect Server) can obtain sensitive information they are not authorized to see by issuing the CREATE WRAPPER command, which is improperly authorized. The vulnerability is rated CVSS 3.1 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), so it requires a remote attacker to already hold valid Db2 credentials and the privilege to invoke CREATE WRAPPER; there is no integrity or availability impact, making this primarily an insider or compromised-credential risk rather than an unauthenticated breach vector. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited, but fixed code is available from IBM and should be applied, particularly in environments where federation features are enabled.
Privilege escalation in IBM Db2 LUW (versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 on Linux, UNIX and Windows, including Db2 Connect Server) lets a locally authenticated low-privilege user elevate to higher privileges through improper privilege management, with high impact to confidentiality, integrity and availability and a scope change that can affect resources beyond the vulnerable component. Exploitation is constrained: the attacker must already hold a local foothold on the host and valid low-privilege credentials (CVSS vector AV:L/PR:L/UI:N), so this is not reachable by a remote unauthenticated adversary and realistically affects insiders or attackers who have breached another service on the same host. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; a vendor patch is available, making this a credible, actionable priority for exposed Db2 LUW estate rather than an emergency.
Privilege escalation in IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 allows a local low-privileged attacker to gain elevated privileges on the Db2 host when the db2locssh feature is enabled. The vulnerability is not remotely reachable and requires an existing local account, making it a post-foothold escalation vector rather than a remote entry point. No public exploit code has been identified at the time of analysis, and IBM has released patches; this is a credible operational priority for environments with db2locssh enabled, but not an emergency.
Arbitrary file write in IBM Db2 11.5.x and 12.1.x allows a remote unauthenticated attacker to write files to attacker-controlled paths on the database server due to improper validation of file path inputs. The vulnerability carries CWE-22 (Path Traversal) and was disclosed by IBM with a patch available at their support portal. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, though the PR:N/AC:L CVSS vector signals low-friction remote reachability.
Stack-based buffer overflow in the IBM Db2 DRDA client allows full system compromise on any host running an affected Db2 client version when that client connects to an attacker-controlled or impersonated DRDA server endpoint. Affected versions are Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5. By controlling a rogue or man-in-the-middle DRDA server, an unauthenticated network adversary can cause the client to copy unbounded server-supplied data into a fixed-size stack buffer, yielding arbitrary command execution. No public exploit is identified at time of analysis; vendor patch is available via IBM Support.
Denial of service in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.5 allows a low-privileged authenticated network user to disable specific server functionality under certain conditions, producing both availability and integrity impact. The root cause is CWE-269 (Improper Privilege Management): the server fails to enforce correct privilege boundaries around a particular Db2 operation, allowing a user whose authorization should not extend to that action to invoke it. No public exploit has been identified at time of analysis; IBM has released a patch and the vendor advisory is the sole remediation reference.
Memory-corruption in IBM Db2's IXF file IMPORT parser lets an attacker supply a crafted IXF data file that overflows a stack buffer (CWE-121), affecting Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 on all listed platforms. Successful exploitation can crash the database engine or lead to code execution in the Db2 server process, yielding total loss of confidentiality, integrity, and availability. IBM has released a fix; there is no public exploit identified at time of analysis and CISA SSVC currently rates exploitation as 'none'.
Privilege escalation in IBM Db2 (data server versions 11.5.0-11.5.9 and 12.1.0-12.1.5) allows an attacker to submit a specially crafted query that bypasses authorization controls and gains elevated database privileges, classified as CWE-285 improper authorization. IBM reported the issue and has published a fix; there is no public exploit identified at time of analysis and it is not on CISA KEV. EPSS is low at 0.32% (25th percentile) despite the 9.8 CVSS, indicating no observed mass-exploitation activity yet.
IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 expose an improper authorization flaw in certain database commands, enabling a low-privileged authenticated user to bypass server-side authority checks and directly modify database catalog data. The root cause is CWE-602 (client-side enforcement of server-side security), where authorization validation is not properly enforced at the server layer. No public exploit has been identified and SSVC rates exploitation as none currently, though the high integrity impact against catalog metadata - which governs schema definitions and access control structures - makes this a meaningful patching priority for all affected Db2 deployments.
Stack-based buffer overflow in IBM Db2's setgid helper binary db2flacc allows a local user with low privileges to overwrite the stack frame and execute arbitrary code with the elevated group permissions of the binary. Both Db2 11.5.x (through 11.5.9) and 12.1.x (through 12.1.4) are affected. No public exploit has been identified and exploitation status is confirmed as none per SSVC, though IBM has released a patch and the SSVC technical impact is rated total, warranting prompt remediation on shared-access Db2 hosts.
Code injection leading to remote code execution affects IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 when an attacker can influence the JDBC connection URL passed to the driver. An attacker who controls the JDBC URL (typically via an application that builds connection strings from user input) can inject malicious properties or references that cause arbitrary code to execute in the context of the connecting application/driver host. IBM has released a fix; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Remote code execution in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.4 lets unauthenticated network attackers run arbitrary code by abusing improper handling of the pre-authentication DRDA handshake. Because the flaw is reachable before any login, any client able to reach the database listener can trigger it, and the CVSS 3.1 base score of 9.8 reflects full compromise of confidentiality, integrity, and availability. No public exploit is identified at time of analysis and the CVE is not listed in CISA KEV.
Authorization bypass in IBM Db2 12.1.0 through 12.1.4 allows remote, unauthenticated attackers to manipulate data written to a remote object storage path by submitting a specially crafted query, an integrity-only impact (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Exposure is conditional rather than universal: only Db2 instances configured to integrate with remote object storage expose the vulnerable code path, and there is no public exploit identified at time of analysis (EPSS 0.02%, 7th percentile; CISA SSVC exploitation: none, Automatable: no). Because the flaw yields no confidentiality or availability loss and requires a specific deployment configuration, this is a moderate-priority issue rather than an urgent one despite its High CVSS rating.
Memory exhaustion in IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 lets a user who can submit crafted SQL against MDC (multi-dimensional clustering) tables drive the database engine out of memory, degrading or halting availability with no confidentiality or integrity impact. The flaw is only reachable where the deployment actually uses MDC tables and where the triggering queries can be submitted; note that while the published CVSS vector lists PR:N, the assessed vector is PR:L, reflecting that a valid database connection and credentials are realistically required. Exploitation is not automatable per CISA's SSVC assessment (Exploitation: none, Automatable: no, Technical Impact: partial), EPSS is only 0.04% (12th percentile), and no public exploit code has been identified at time of analysis - every signal points to a moderate, low-urgency availability issue rather than a top priority.
Denial of service in IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 allows a user who can submit SQL to exhaust the statement heap with a specially crafted query while the engine is running with a small statement-heap configuration, degrading or halting availability for all sessions on the instance. This is a moderate-priority availability issue, not an urgent one: no public exploit was identified at time of analysis, EPSS is 0.01% (2nd percentile), CISA SSVC records an exploitation value of none with automatable set to no, and only availability is impacted (no confidentiality or integrity loss). The published NVD vector scores PR:N, but our assessment treats realistic exploitation as gated by at least a low-privilege database session (PR:L), and authentication requirements are not fully confirmed from available data and should be verified with IBM.
Denial of service in IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 can be triggered by a specially crafted query when the autonomous transactions feature is enabled, allowing an attacker to exhaust resources and take the database instance down. Exposure is materially limited to deployments that have enabled autonomous transactions and to callers able to submit queries; authentication requirements are not fully confirmed from the available data, and the PR:N rating in the published vector should be verified against IBM's advisory. No public exploit code or active exploitation is identified, EPSS is 0.04% (12th percentile), CISA SSVC records exploitation as none, and the vuln.today priority label is this_week.
Improper input validation in IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 lets a local attacker who already holds authenticated low-privilege access to the database host or instance disrupt the affected component, resulting in a limited availability impact. The issue is not remotely reachable and cannot be triggered by an unauthenticated user; our assessment rates it CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, a low-severity availability-only condition, and there is no public exploit identified at time of analysis. Overall this is a low-priority, low-real-risk issue despite being a named CVE, and vendor patching is available.
Denial of service in IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 can be triggered by an authenticated, low-privileged user (PR:L) submitting a specially crafted query that references a Materialized Query Table, causing a stack-based buffer overflow (CWE-121) that crashes the database engine. IBM has released a patch; no public exploit identified at time of analysis, and impact is limited to availability with no data disclosure or modification. Note that IBM's CVSS vector indicates local access (AV:L), while the query-execution nature suggests a remote authenticated client may be able to trigger the flaw, pending confirmation with the vendor.
Denial of service in IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 can be triggered by an authenticated user who holds INSERT privileges on a table containing one or more XML columns, potentially crashing or hanging the database instance under conditions IBM has not fully quantified. The flaw is classified as uncontrolled resource consumption (CWE-770) and carries a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), meaning the impact is confined to availability with no confidentiality or integrity loss. Exploitation requires a valid Db2 session (PR:L) and typical SQL INSERT access, but no public exploit code has been identified at time of analysis and there is no indication of active exploitation; this is a moderate-priority availability issue rather than a critical emergency. Vendor patches are available per IBM's advisory.
Local privilege escalation in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.5 allows an authenticated low-privileged user on the database host to abuse the db2pd monitoring and diagnostic utility to gain privileges beyond those they legitimately hold. Exploitation requires pre-existing local shell access and the ability to run db2pd, so the flaw is not reachable remotely or by unauthenticated actors; it matters most on shared, multi-tenant, or otherwise privileged-access Db2 servers. Our independent assessment rates the true impact higher than IBM's published CVSS 6.5, scoring it CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H; no public exploit code has been identified and the issue is not confirmed as actively exploited (not in CISA KEV), though a vendor patch is available and should be applied to remove the condition.
Authenticated denial of service in IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 on Linux, UNIX and Windows (including Db2 Connect Server) lets a remote attacker with a valid database session crash the engine by triggering a null pointer dereference. The impact is availability-only (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so confidentiality and integrity of stored data are not directly at risk, but any application or Db2 Connect client depending on the affected instance loses service. No public exploit code has been identified at time of analysis, the flaw is not in CISA KEV, SSVC rates exploitation and automatable both as none/no, and no EPSS score was supplied in the intelligence feed.
IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 on Linux, UNIX and Windows (including Db2 Connect Server) can be driven into a denial-of-service condition by a remote attacker who holds valid database credentials, through uncontrolled consumption of server resources. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so the impact is loss of availability only - no confidentiality or integrity exposure is claimed. Patch exists via IBM support document 7286983; there is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as 'none'.
Authenticated path traversal in IBM Db2 11.5.x and 12.1.x allows a low-privileged database user to write arbitrary files to the underlying host filesystem via a specially crafted network request. The flaw (CWE-22) exploits insufficient pathname restriction in a Db2 request handler, enabling an attacker to place files outside intended directories - potentially overwriting configuration files, scripts, or other OS-level assets writable by the Db2 service account. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory 7286985.
IBM Db2 on Linux, UNIX, and Windows exposes cleartext database passwords by writing them into diagnostic trace files, affecting versions 11.5.0-11.5.9 and 12.1.0-12.1.5, including DB2 Connect Server. Any low-privilege local OS user with read access to the Db2 trace directory can harvest plaintext credentials without requiring database-level authentication or elevated system rights. IBM has released a patch; no active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Memory leak denial of service in IBM Db2 12.1.5 for Linux, UNIX, and Windows (including DB2 Connect Server) enables a local attacker with low-privilege credentials to exhaust system resources and degrade database availability. Rooted in CWE-770 (uncontrolled resource allocation), the flaw requires no user interaction beyond an authenticated local session. No public exploit code or active exploitation is identified; IBM has released a patch via its support portal.
Denial of service in IBM Db2 federated server (versions 12.1.0 through 12.1.4) can be triggered by executing non-fenced federated queries, causing the database engine to exhaust resources and become unresponsive. The root cause is CWE-400 (Uncontrolled Resource Consumption) within the in-process federated wrapper execution path. No public exploit has been identified at time of analysis, and IBM has released a patch via their support portal.
Denial of service in IBM Db2 11.5.x and 12.1.x allows a local database user to crash the database engine by submitting specially crafted SQL statements containing subqueries that trigger an infinite loop (CWE-835) in the query compiler. The vulnerability spans two active major release lines - 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 - covering a broad swath of IBM's current Db2 product lifecycle. No public exploit code or active exploitation has been identified at time of analysis; IBM has released a patch via the vendor advisory.
Denial of service in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.4 allows an authenticated low-privileged user to crash or hang the database server by submitting a crafted SQL query exploiting improper neutralization of special elements in XMLTable-derived column processing logic. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms this is remotely triggerable with minimal privileges, posing a realistic insider-threat or compromised-credential availability risk. No public exploit code or active exploitation has been identified at time of analysis.
IBM Db2 versions 11.5.0-11.5.9 and 12.1.0-12.1.4 expose sensitive information through internal monitoring and event tables to authenticated low-privilege local users, a consequence of CWE-538 where sensitive data is inserted into storage locations accessible beyond the intended trust boundary. The CVSS vector confirms local-only attack surface (AV:L) with low-privilege authentication (PR:L) and high confidentiality impact, making this most relevant to insider threat scenarios or post-compromise lateral movement in multi-tenant Db2 environments. No public exploit code exists and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis.
Denial of service in IBM Db2 11.5.x and 12.1.x allows a low-privileged local user to crash the database engine by executing a specially crafted query against range partitioned tables. The vulnerability stems from uncontrolled resource allocation (CWE-770) during query processing, resulting in complete availability loss with no impact to confidentiality or integrity. No public exploit code exists and this vulnerability has not been listed in the CISA KEV catalog at time of analysis.
IBM Db2 on Linux, UNIX, and Windows - versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4, including DB2 Connect Server - writes potentially sensitive information into log files readable by local OS users, creating an insider-threat-class confidentiality exposure. The CVSS confidentiality impact is rated High (C:H), but the attack is strictly local (AV:L) and requires only a standard low-privilege OS account (PR:L), making this a post-access or insider-threat scenario rather than an internet-facing risk. No public exploit has been identified at time of analysis, EPSS sits at the 2nd percentile (0.01%), and CISA SSVC records no active exploitation - IBM has released a patch addressed in advisory https://www.ibm.com/support/pages/node/7273554.
Denial of service in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.4 allows authenticated users to crash the database server via improper neutralization of special elements in query logic. An attacker with valid database credentials can trigger the vulnerability remotely without user interaction, resulting in service unavailability. No active exploitation has been confirmed at time of analysis.
Denial of service in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.3 for Linux, UNIX, and Windows allows authenticated users to crash the database server by submitting a specially crafted SQL query that triggers improper system resource allocation. An attacker with valid database credentials can exhaust resources and render the database unavailable to legitimate users without leaving data corruption or unauthorized access. No public exploit code has been identified, though the vulnerability requires only valid authentication and a standard SQL interface.
Denial of service in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.3 allows authenticated users to crash the database server via improper neutralization of special elements in query logic when specific configurations are present. Attack requires valid database credentials and high attack complexity, limiting exploitation to insiders or users with legitimate access. Vendor has released patches addressing the underlying query parsing flaw.
Authenticated users can trigger a denial of service in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.4 for Linux, UNIX, and Windows through improper neutralization of special elements in database query logic, causing service unavailability without requiring user interaction or special configuration. The vulnerability affects both standalone Db2 instances and Db2 Connect Server deployments, with CVSS 6.5 reflecting network accessibility and authenticated access requirements. No public exploit code or active exploitation has been identified at the time of analysis.
Db2 versions up to 12.1.3 contains a vulnerability that allows attackers to an authenticated user to obtain sensitive information under specific HADR config (CVSS 5.3).
Db2 versions up to 12.1.3 is affected by improper restriction of xml external entity reference (CVSS 7.1).
Db2 contains a vulnerability that allows attackers to an authenticated user to cause a denial of service due to improper neutralizatio (CVSS 6.5).
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in data query logic
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query with XML columns. [CVSS 6.5 MEDIUM]
Db2 contains a vulnerability that allows attackers to an authenticated user to cause a denial of service due to improper neutralizatio (CVSS 5.3).
Db2 contains a vulnerability that allows attackers to cause a denial of service due to insufficient validation of special elements in (CVSS 6.5).
Db2 contains a vulnerability that allows attackers to cause a denial of service due to improper neutralization of special elements in (CVSS 6.5).
Db2 contains a vulnerability that allows attackers to a local user to cause a denial of service due to improper neutralization of spec (CVSS 6.5).
IBM® Db2® is vulnerable to a denial of service with a specially crafted query that uses ALTER TABLE operations. [CVSS 6.5 MEDIUM]
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 - 11.5.9 could allow an authenticated user to cause a denial of service when given specially crafted query. [CVSS 6.5 MEDIUM]
Db2 contains a vulnerability that allows attackers to a local user with filesystem access to escalate their privileges due to the use (CVSS 8.4).
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a user to cause a denial of service by executing a query that invokes the JSON_Object scalar function, which may trigger an unhandled exception leading to abnormal server termination. [CVSS 6.5 MEDIUM]
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 under specific configuration of cataloged remote storage aliases could allow an authenticated user to execute unauthorized commands due to an authorization bypass vulnerability using a user-controlled key. [CVSS 6.8 MEDIUM]
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow a local user to cause a denial of service due to improper neutralization of special elements in data query logic. [CVSS 6.2 MEDIUM]
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 could allow an instance owner to execute malicious code that escalate their privileges to root due to execution of unnecessary privileges operated at a higher than minimum level. [CVSS 7.2 HIGH]
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow a local user to cause a denial of service when copying large table containing XML data due to improper allocation of system resources. [CVSS 6.2 MEDIUM]
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of service due to improper allocation of resources. [CVSS 6.5 MEDIUM]
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 is vulnerable to a denial of service as a trap may occur when selecting from certain types of tables. [CVSS 6.5 MEDIUM]
Db2 contains a vulnerability that allows attackers to an authenticated user to cause a denial of service due to excessive use of a glo (CVSS 6.5).
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of service using a specially crafted SQL statement including XML that performs uncontrolled recursion. [CVSS 6.5 MEDIUM]
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 is vulnerable to a denial of service as the server may crash when an authenticated user creates a specially crafted query. [CVSS 6.5 MEDIUM]
Local privilege escalation to root in IBM Db2 12.1.0 through 12.1.3 for Linux, UNIX and Windows (including Db2 Connect Server) allows an attacker who already holds a low-privileged local account on the database host to execute malicious code that elevates them to root, because a Db2 component is configured to run with higher-than-minimum privileges (CWE-250, execution with unnecessary privileges). Exploitation requires both prior local access (AV:L, PR:L, UI:N) and a Db2 instance running in one of the specific configurations IBM calls out in advisory node 7250486, so default or unrelated configurations are not affected. This is a genuine but moderate-priority local privilege escalation rather than a broadly reachable flaw: CVSS 3.1 base score is 7.8 with high confidentiality, integrity and availability impact, EPSS is only about 0.03% (7th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis.
IBM Db2 12.1.0 through 12.1.2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a local user to cause a denial of service due to improper neutralization of special elements in. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local user to cause a denial of service due to the database monitor. Rated medium severity (CVSS 5.1), this vulnerability is no authentication required. No vendor patch available.
IBM Db2 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) clpplus command exposes user credentials to the terminal. Rated medium severity (CVSS 4.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial of service due to improper. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Db2 for Linux (10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3) fails to properly invalidate expired credentials, so an authenticated user holding a stale, already-expired password can regain access to an account that has been locked out. The issue maps to CWE-324 (use of a key past its expiration date) and only manifests when a pre-existing Db2 account is simultaneously locked out and past its password expiration date, which narrows realistic exploitation to insiders or holders of stale credentials. No public exploit code has been identified at time of analysis and the EPSS score is negligible at 0.03% (10th percentile); the vendor's CVSS of 8.8 is inconsistent with the described behavior and the independently assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), so it should be treated with caution.
A crafted SQL query can crash IBM Db2 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 on Linux, UNIX, and Windows - including Db2 Connect Server - producing a full denial of service against the database instance. The root cause is CWE-789 (uncontrolled memory allocation): the server attempts an excessive allocation when processing the specially crafted query and terminates. IBM's published vector scores this 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), while our assessment places the realistic vector at PR:L, since delivering the malicious query in practice requires a valid, query-capable database session rather than an anonymous network packet; the practical barrier is therefore access to an authenticated connection plus network reachability to the Db2 listener. There is no CISA KEV listing and no public exploit code identified at time of analysis, and EPSS is low at 0.10% (28th percentile), so this reads as a moderate, availability-only risk rather than an emergency - but any crash of a production Db2 instance is business-impacting, so patching on a normal maintenance cadence remains appropriate.
A specially crafted SQL query can crash IBM Db2 for Linux, UNIX and Windows, including Db2 Connect Server, producing a denial of service in versions 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3. The issue is scored CVSS 7.5 with availability-only impact (C:N/I:N/A:H), and while the published vector claims PR:N, our independent assessment holds that submitting the malicious query in practice presupposes network reachability to the database listener and a valid authenticated Db2 session, so credentialed access is the likely prerequisite. No public exploit code has been identified at time of analysis and there is no evidence of active exploitation; EPSS is low at 0.14% (34th percentile), consistent with a targeted, availability-focused flaw in an enterprise database.
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 could allow an authenticated user to cause a denial of service when using Q. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 is vulnerable to a denial of service as the server may crash under certain conditions. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 is vulnerable to a denial of service as the server may crash. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 12.1.0 through 12.1.1 could allow an authenticated user to cause a denial of service due to concurrent execution of shared resources. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 could allow an authenticated user to cause a denial of service when connecting to a. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 under specific configurations could allow an authenticated user to cause a denial of. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 could allow an authenticated user in federation environment, to cause a denial of. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows 12.1.0 and 12.1.1 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to an information disclosure vulnerability as sensitive information may be included in a log file under specific. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 could allow an authenticated user to cause a denial of service with a specially crafted query due to improper. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1, 11.5, and 12.1 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service, under specific configurations, as the server may crash when using a. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 could allow an authenticated user to cause a denial of service with a specially crafted query due to improper memory. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow an authenticated user to cause a denial of service with a specially crafted query due to improper memory allocation. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) federated server 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query under certain non default. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to a denial of service, under specific non default configurations, as the server may crash when using a. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may crash when using a specially crafted query on certain. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query under certain conditions. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5, 11.1, and 11.5 federated server is vulnerable to denial of service with a specially crafted query under certain conditions. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to a denial of service by an authenticated user using a specially crafted query. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 stores potentially sensitive information in log files that could be read by a local user. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to a denial of service with a specially crafted query on certain columnar tables. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authenticated users of IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (including DB2 Connect Server) can obtain sensitive information they are not authorized to see by issuing the CREATE WRAPPER command, which is improperly authorized. The vulnerability is rated CVSS 3.1 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), so it requires a remote attacker to already hold valid Db2 credentials and the privilege to invoke CREATE WRAPPER; there is no integrity or availability impact, making this primarily an insider or compromised-credential risk rather than an unauthenticated breach vector. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited, but fixed code is available from IBM and should be applied, particularly in environments where federation features are enabled.
Privilege escalation in IBM Db2 LUW (versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 on Linux, UNIX and Windows, including Db2 Connect Server) lets a locally authenticated low-privilege user elevate to higher privileges through improper privilege management, with high impact to confidentiality, integrity and availability and a scope change that can affect resources beyond the vulnerable component. Exploitation is constrained: the attacker must already hold a local foothold on the host and valid low-privilege credentials (CVSS vector AV:L/PR:L/UI:N), so this is not reachable by a remote unauthenticated adversary and realistically affects insiders or attackers who have breached another service on the same host. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; a vendor patch is available, making this a credible, actionable priority for exposed Db2 LUW estate rather than an emergency.
Privilege escalation in IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 allows a local low-privileged attacker to gain elevated privileges on the Db2 host when the db2locssh feature is enabled. The vulnerability is not remotely reachable and requires an existing local account, making it a post-foothold escalation vector rather than a remote entry point. No public exploit code has been identified at the time of analysis, and IBM has released patches; this is a credible operational priority for environments with db2locssh enabled, but not an emergency.
Arbitrary file write in IBM Db2 11.5.x and 12.1.x allows a remote unauthenticated attacker to write files to attacker-controlled paths on the database server due to improper validation of file path inputs. The vulnerability carries CWE-22 (Path Traversal) and was disclosed by IBM with a patch available at their support portal. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, though the PR:N/AC:L CVSS vector signals low-friction remote reachability.
Stack-based buffer overflow in the IBM Db2 DRDA client allows full system compromise on any host running an affected Db2 client version when that client connects to an attacker-controlled or impersonated DRDA server endpoint. Affected versions are Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5. By controlling a rogue or man-in-the-middle DRDA server, an unauthenticated network adversary can cause the client to copy unbounded server-supplied data into a fixed-size stack buffer, yielding arbitrary command execution. No public exploit is identified at time of analysis; vendor patch is available via IBM Support.
Denial of service in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.5 allows a low-privileged authenticated network user to disable specific server functionality under certain conditions, producing both availability and integrity impact. The root cause is CWE-269 (Improper Privilege Management): the server fails to enforce correct privilege boundaries around a particular Db2 operation, allowing a user whose authorization should not extend to that action to invoke it. No public exploit has been identified at time of analysis; IBM has released a patch and the vendor advisory is the sole remediation reference.
Memory-corruption in IBM Db2's IXF file IMPORT parser lets an attacker supply a crafted IXF data file that overflows a stack buffer (CWE-121), affecting Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 on all listed platforms. Successful exploitation can crash the database engine or lead to code execution in the Db2 server process, yielding total loss of confidentiality, integrity, and availability. IBM has released a fix; there is no public exploit identified at time of analysis and CISA SSVC currently rates exploitation as 'none'.
Privilege escalation in IBM Db2 (data server versions 11.5.0-11.5.9 and 12.1.0-12.1.5) allows an attacker to submit a specially crafted query that bypasses authorization controls and gains elevated database privileges, classified as CWE-285 improper authorization. IBM reported the issue and has published a fix; there is no public exploit identified at time of analysis and it is not on CISA KEV. EPSS is low at 0.32% (25th percentile) despite the 9.8 CVSS, indicating no observed mass-exploitation activity yet.
IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 expose an improper authorization flaw in certain database commands, enabling a low-privileged authenticated user to bypass server-side authority checks and directly modify database catalog data. The root cause is CWE-602 (client-side enforcement of server-side security), where authorization validation is not properly enforced at the server layer. No public exploit has been identified and SSVC rates exploitation as none currently, though the high integrity impact against catalog metadata - which governs schema definitions and access control structures - makes this a meaningful patching priority for all affected Db2 deployments.
Stack-based buffer overflow in IBM Db2's setgid helper binary db2flacc allows a local user with low privileges to overwrite the stack frame and execute arbitrary code with the elevated group permissions of the binary. Both Db2 11.5.x (through 11.5.9) and 12.1.x (through 12.1.4) are affected. No public exploit has been identified and exploitation status is confirmed as none per SSVC, though IBM has released a patch and the SSVC technical impact is rated total, warranting prompt remediation on shared-access Db2 hosts.
Code injection leading to remote code execution affects IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 when an attacker can influence the JDBC connection URL passed to the driver. An attacker who controls the JDBC URL (typically via an application that builds connection strings from user input) can inject malicious properties or references that cause arbitrary code to execute in the context of the connecting application/driver host. IBM has released a fix; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Remote code execution in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.4 lets unauthenticated network attackers run arbitrary code by abusing improper handling of the pre-authentication DRDA handshake. Because the flaw is reachable before any login, any client able to reach the database listener can trigger it, and the CVSS 3.1 base score of 9.8 reflects full compromise of confidentiality, integrity, and availability. No public exploit is identified at time of analysis and the CVE is not listed in CISA KEV.
Authorization bypass in IBM Db2 12.1.0 through 12.1.4 allows remote, unauthenticated attackers to manipulate data written to a remote object storage path by submitting a specially crafted query, an integrity-only impact (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Exposure is conditional rather than universal: only Db2 instances configured to integrate with remote object storage expose the vulnerable code path, and there is no public exploit identified at time of analysis (EPSS 0.02%, 7th percentile; CISA SSVC exploitation: none, Automatable: no). Because the flaw yields no confidentiality or availability loss and requires a specific deployment configuration, this is a moderate-priority issue rather than an urgent one despite its High CVSS rating.
Memory exhaustion in IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 lets a user who can submit crafted SQL against MDC (multi-dimensional clustering) tables drive the database engine out of memory, degrading or halting availability with no confidentiality or integrity impact. The flaw is only reachable where the deployment actually uses MDC tables and where the triggering queries can be submitted; note that while the published CVSS vector lists PR:N, the assessed vector is PR:L, reflecting that a valid database connection and credentials are realistically required. Exploitation is not automatable per CISA's SSVC assessment (Exploitation: none, Automatable: no, Technical Impact: partial), EPSS is only 0.04% (12th percentile), and no public exploit code has been identified at time of analysis - every signal points to a moderate, low-urgency availability issue rather than a top priority.
Denial of service in IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 allows a user who can submit SQL to exhaust the statement heap with a specially crafted query while the engine is running with a small statement-heap configuration, degrading or halting availability for all sessions on the instance. This is a moderate-priority availability issue, not an urgent one: no public exploit was identified at time of analysis, EPSS is 0.01% (2nd percentile), CISA SSVC records an exploitation value of none with automatable set to no, and only availability is impacted (no confidentiality or integrity loss). The published NVD vector scores PR:N, but our assessment treats realistic exploitation as gated by at least a low-privilege database session (PR:L), and authentication requirements are not fully confirmed from available data and should be verified with IBM.
Denial of service in IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 can be triggered by a specially crafted query when the autonomous transactions feature is enabled, allowing an attacker to exhaust resources and take the database instance down. Exposure is materially limited to deployments that have enabled autonomous transactions and to callers able to submit queries; authentication requirements are not fully confirmed from the available data, and the PR:N rating in the published vector should be verified against IBM's advisory. No public exploit code or active exploitation is identified, EPSS is 0.04% (12th percentile), CISA SSVC records exploitation as none, and the vuln.today priority label is this_week.
Improper input validation in IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 lets a local attacker who already holds authenticated low-privilege access to the database host or instance disrupt the affected component, resulting in a limited availability impact. The issue is not remotely reachable and cannot be triggered by an unauthenticated user; our assessment rates it CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, a low-severity availability-only condition, and there is no public exploit identified at time of analysis. Overall this is a low-priority, low-real-risk issue despite being a named CVE, and vendor patching is available.
Denial of service in IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 can be triggered by an authenticated, low-privileged user (PR:L) submitting a specially crafted query that references a Materialized Query Table, causing a stack-based buffer overflow (CWE-121) that crashes the database engine. IBM has released a patch; no public exploit identified at time of analysis, and impact is limited to availability with no data disclosure or modification. Note that IBM's CVSS vector indicates local access (AV:L), while the query-execution nature suggests a remote authenticated client may be able to trigger the flaw, pending confirmation with the vendor.
Denial of service in IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 can be triggered by an authenticated user who holds INSERT privileges on a table containing one or more XML columns, potentially crashing or hanging the database instance under conditions IBM has not fully quantified. The flaw is classified as uncontrolled resource consumption (CWE-770) and carries a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), meaning the impact is confined to availability with no confidentiality or integrity loss. Exploitation requires a valid Db2 session (PR:L) and typical SQL INSERT access, but no public exploit code has been identified at time of analysis and there is no indication of active exploitation; this is a moderate-priority availability issue rather than a critical emergency. Vendor patches are available per IBM's advisory.
Local privilege escalation in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.5 allows an authenticated low-privileged user on the database host to abuse the db2pd monitoring and diagnostic utility to gain privileges beyond those they legitimately hold. Exploitation requires pre-existing local shell access and the ability to run db2pd, so the flaw is not reachable remotely or by unauthenticated actors; it matters most on shared, multi-tenant, or otherwise privileged-access Db2 servers. Our independent assessment rates the true impact higher than IBM's published CVSS 6.5, scoring it CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H; no public exploit code has been identified and the issue is not confirmed as actively exploited (not in CISA KEV), though a vendor patch is available and should be applied to remove the condition.
Authenticated denial of service in IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 on Linux, UNIX and Windows (including Db2 Connect Server) lets a remote attacker with a valid database session crash the engine by triggering a null pointer dereference. The impact is availability-only (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so confidentiality and integrity of stored data are not directly at risk, but any application or Db2 Connect client depending on the affected instance loses service. No public exploit code has been identified at time of analysis, the flaw is not in CISA KEV, SSVC rates exploitation and automatable both as none/no, and no EPSS score was supplied in the intelligence feed.
IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 on Linux, UNIX and Windows (including Db2 Connect Server) can be driven into a denial-of-service condition by a remote attacker who holds valid database credentials, through uncontrolled consumption of server resources. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so the impact is loss of availability only - no confidentiality or integrity exposure is claimed. Patch exists via IBM support document 7286983; there is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as 'none'.
Authenticated path traversal in IBM Db2 11.5.x and 12.1.x allows a low-privileged database user to write arbitrary files to the underlying host filesystem via a specially crafted network request. The flaw (CWE-22) exploits insufficient pathname restriction in a Db2 request handler, enabling an attacker to place files outside intended directories - potentially overwriting configuration files, scripts, or other OS-level assets writable by the Db2 service account. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory 7286985.
IBM Db2 on Linux, UNIX, and Windows exposes cleartext database passwords by writing them into diagnostic trace files, affecting versions 11.5.0-11.5.9 and 12.1.0-12.1.5, including DB2 Connect Server. Any low-privilege local OS user with read access to the Db2 trace directory can harvest plaintext credentials without requiring database-level authentication or elevated system rights. IBM has released a patch; no active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Memory leak denial of service in IBM Db2 12.1.5 for Linux, UNIX, and Windows (including DB2 Connect Server) enables a local attacker with low-privilege credentials to exhaust system resources and degrade database availability. Rooted in CWE-770 (uncontrolled resource allocation), the flaw requires no user interaction beyond an authenticated local session. No public exploit code or active exploitation is identified; IBM has released a patch via its support portal.
Denial of service in IBM Db2 federated server (versions 12.1.0 through 12.1.4) can be triggered by executing non-fenced federated queries, causing the database engine to exhaust resources and become unresponsive. The root cause is CWE-400 (Uncontrolled Resource Consumption) within the in-process federated wrapper execution path. No public exploit has been identified at time of analysis, and IBM has released a patch via their support portal.
Denial of service in IBM Db2 11.5.x and 12.1.x allows a local database user to crash the database engine by submitting specially crafted SQL statements containing subqueries that trigger an infinite loop (CWE-835) in the query compiler. The vulnerability spans two active major release lines - 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 - covering a broad swath of IBM's current Db2 product lifecycle. No public exploit code or active exploitation has been identified at time of analysis; IBM has released a patch via the vendor advisory.
Denial of service in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.4 allows an authenticated low-privileged user to crash or hang the database server by submitting a crafted SQL query exploiting improper neutralization of special elements in XMLTable-derived column processing logic. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms this is remotely triggerable with minimal privileges, posing a realistic insider-threat or compromised-credential availability risk. No public exploit code or active exploitation has been identified at time of analysis.
IBM Db2 versions 11.5.0-11.5.9 and 12.1.0-12.1.4 expose sensitive information through internal monitoring and event tables to authenticated low-privilege local users, a consequence of CWE-538 where sensitive data is inserted into storage locations accessible beyond the intended trust boundary. The CVSS vector confirms local-only attack surface (AV:L) with low-privilege authentication (PR:L) and high confidentiality impact, making this most relevant to insider threat scenarios or post-compromise lateral movement in multi-tenant Db2 environments. No public exploit code exists and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis.
Denial of service in IBM Db2 11.5.x and 12.1.x allows a low-privileged local user to crash the database engine by executing a specially crafted query against range partitioned tables. The vulnerability stems from uncontrolled resource allocation (CWE-770) during query processing, resulting in complete availability loss with no impact to confidentiality or integrity. No public exploit code exists and this vulnerability has not been listed in the CISA KEV catalog at time of analysis.
IBM Db2 on Linux, UNIX, and Windows - versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4, including DB2 Connect Server - writes potentially sensitive information into log files readable by local OS users, creating an insider-threat-class confidentiality exposure. The CVSS confidentiality impact is rated High (C:H), but the attack is strictly local (AV:L) and requires only a standard low-privilege OS account (PR:L), making this a post-access or insider-threat scenario rather than an internet-facing risk. No public exploit has been identified at time of analysis, EPSS sits at the 2nd percentile (0.01%), and CISA SSVC records no active exploitation - IBM has released a patch addressed in advisory https://www.ibm.com/support/pages/node/7273554.
Denial of service in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.4 allows authenticated users to crash the database server via improper neutralization of special elements in query logic. An attacker with valid database credentials can trigger the vulnerability remotely without user interaction, resulting in service unavailability. No active exploitation has been confirmed at time of analysis.
Denial of service in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.3 for Linux, UNIX, and Windows allows authenticated users to crash the database server by submitting a specially crafted SQL query that triggers improper system resource allocation. An attacker with valid database credentials can exhaust resources and render the database unavailable to legitimate users without leaving data corruption or unauthorized access. No public exploit code has been identified, though the vulnerability requires only valid authentication and a standard SQL interface.
Denial of service in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.3 allows authenticated users to crash the database server via improper neutralization of special elements in query logic when specific configurations are present. Attack requires valid database credentials and high attack complexity, limiting exploitation to insiders or users with legitimate access. Vendor has released patches addressing the underlying query parsing flaw.
Authenticated users can trigger a denial of service in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.4 for Linux, UNIX, and Windows through improper neutralization of special elements in database query logic, causing service unavailability without requiring user interaction or special configuration. The vulnerability affects both standalone Db2 instances and Db2 Connect Server deployments, with CVSS 6.5 reflecting network accessibility and authenticated access requirements. No public exploit code or active exploitation has been identified at the time of analysis.
Db2 versions up to 12.1.3 contains a vulnerability that allows attackers to an authenticated user to obtain sensitive information under specific HADR config (CVSS 5.3).
Db2 versions up to 12.1.3 is affected by improper restriction of xml external entity reference (CVSS 7.1).
Db2 contains a vulnerability that allows attackers to an authenticated user to cause a denial of service due to improper neutralizatio (CVSS 6.5).
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in data query logic
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query with XML columns. [CVSS 6.5 MEDIUM]
Db2 contains a vulnerability that allows attackers to an authenticated user to cause a denial of service due to improper neutralizatio (CVSS 5.3).
Db2 contains a vulnerability that allows attackers to cause a denial of service due to insufficient validation of special elements in (CVSS 6.5).
Db2 contains a vulnerability that allows attackers to cause a denial of service due to improper neutralization of special elements in (CVSS 6.5).
Db2 contains a vulnerability that allows attackers to a local user to cause a denial of service due to improper neutralization of spec (CVSS 6.5).
IBM® Db2® is vulnerable to a denial of service with a specially crafted query that uses ALTER TABLE operations. [CVSS 6.5 MEDIUM]
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 - 11.5.9 could allow an authenticated user to cause a denial of service when given specially crafted query. [CVSS 6.5 MEDIUM]
Db2 contains a vulnerability that allows attackers to a local user with filesystem access to escalate their privileges due to the use (CVSS 8.4).
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a user to cause a denial of service by executing a query that invokes the JSON_Object scalar function, which may trigger an unhandled exception leading to abnormal server termination. [CVSS 6.5 MEDIUM]
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 under specific configuration of cataloged remote storage aliases could allow an authenticated user to execute unauthorized commands due to an authorization bypass vulnerability using a user-controlled key. [CVSS 6.8 MEDIUM]
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow a local user to cause a denial of service due to improper neutralization of special elements in data query logic. [CVSS 6.2 MEDIUM]
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 could allow an instance owner to execute malicious code that escalate their privileges to root due to execution of unnecessary privileges operated at a higher than minimum level. [CVSS 7.2 HIGH]
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow a local user to cause a denial of service when copying large table containing XML data due to improper allocation of system resources. [CVSS 6.2 MEDIUM]
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of service due to improper allocation of resources. [CVSS 6.5 MEDIUM]
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 is vulnerable to a denial of service as a trap may occur when selecting from certain types of tables. [CVSS 6.5 MEDIUM]
Db2 contains a vulnerability that allows attackers to an authenticated user to cause a denial of service due to excessive use of a glo (CVSS 6.5).
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of service using a specially crafted SQL statement including XML that performs uncontrolled recursion. [CVSS 6.5 MEDIUM]
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 is vulnerable to a denial of service as the server may crash when an authenticated user creates a specially crafted query. [CVSS 6.5 MEDIUM]
Local privilege escalation to root in IBM Db2 12.1.0 through 12.1.3 for Linux, UNIX and Windows (including Db2 Connect Server) allows an attacker who already holds a low-privileged local account on the database host to execute malicious code that elevates them to root, because a Db2 component is configured to run with higher-than-minimum privileges (CWE-250, execution with unnecessary privileges). Exploitation requires both prior local access (AV:L, PR:L, UI:N) and a Db2 instance running in one of the specific configurations IBM calls out in advisory node 7250486, so default or unrelated configurations are not affected. This is a genuine but moderate-priority local privilege escalation rather than a broadly reachable flaw: CVSS 3.1 base score is 7.8 with high confidentiality, integrity and availability impact, EPSS is only about 0.03% (7th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis.
IBM Db2 12.1.0 through 12.1.2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a local user to cause a denial of service due to improper neutralization of special elements in. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local user to cause a denial of service due to the database monitor. Rated medium severity (CVSS 5.1), this vulnerability is no authentication required. No vendor patch available.
IBM Db2 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) clpplus command exposes user credentials to the terminal. Rated medium severity (CVSS 4.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial of service due to improper. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Db2 for Linux (10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3) fails to properly invalidate expired credentials, so an authenticated user holding a stale, already-expired password can regain access to an account that has been locked out. The issue maps to CWE-324 (use of a key past its expiration date) and only manifests when a pre-existing Db2 account is simultaneously locked out and past its password expiration date, which narrows realistic exploitation to insiders or holders of stale credentials. No public exploit code has been identified at time of analysis and the EPSS score is negligible at 0.03% (10th percentile); the vendor's CVSS of 8.8 is inconsistent with the described behavior and the independently assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), so it should be treated with caution.
A crafted SQL query can crash IBM Db2 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 on Linux, UNIX, and Windows - including Db2 Connect Server - producing a full denial of service against the database instance. The root cause is CWE-789 (uncontrolled memory allocation): the server attempts an excessive allocation when processing the specially crafted query and terminates. IBM's published vector scores this 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), while our assessment places the realistic vector at PR:L, since delivering the malicious query in practice requires a valid, query-capable database session rather than an anonymous network packet; the practical barrier is therefore access to an authenticated connection plus network reachability to the Db2 listener. There is no CISA KEV listing and no public exploit code identified at time of analysis, and EPSS is low at 0.10% (28th percentile), so this reads as a moderate, availability-only risk rather than an emergency - but any crash of a production Db2 instance is business-impacting, so patching on a normal maintenance cadence remains appropriate.
A specially crafted SQL query can crash IBM Db2 for Linux, UNIX and Windows, including Db2 Connect Server, producing a denial of service in versions 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3. The issue is scored CVSS 7.5 with availability-only impact (C:N/I:N/A:H), and while the published vector claims PR:N, our independent assessment holds that submitting the malicious query in practice presupposes network reachability to the database listener and a valid authenticated Db2 session, so credentialed access is the likely prerequisite. No public exploit code has been identified at time of analysis and there is no evidence of active exploitation; EPSS is low at 0.14% (34th percentile), consistent with a targeted, availability-focused flaw in an enterprise database.
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 could allow an authenticated user to cause a denial of service when using Q. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 is vulnerable to a denial of service as the server may crash under certain conditions. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 is vulnerable to a denial of service as the server may crash. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 12.1.0 through 12.1.1 could allow an authenticated user to cause a denial of service due to concurrent execution of shared resources. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 could allow an authenticated user to cause a denial of service when connecting to a. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 under specific configurations could allow an authenticated user to cause a denial of. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 could allow an authenticated user in federation environment, to cause a denial of. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows 12.1.0 and 12.1.1 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to an information disclosure vulnerability as sensitive information may be included in a log file under specific. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 could allow an authenticated user to cause a denial of service with a specially crafted query due to improper. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1, 11.5, and 12.1 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service, under specific configurations, as the server may crash when using a. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 could allow an authenticated user to cause a denial of service with a specially crafted query due to improper memory. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow an authenticated user to cause a denial of service with a specially crafted query due to improper memory allocation. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) federated server 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query under certain non default. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to a denial of service, under specific non default configurations, as the server may crash when using a. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may crash when using a specially crafted query on certain. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query under certain conditions. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5, 11.1, and 11.5 federated server is vulnerable to denial of service with a specially crafted query under certain conditions. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to a denial of service by an authenticated user using a specially crafted query. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 stores potentially sensitive information in log files that could be read by a local user. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to a denial of service with a specially crafted query on certain columnar tables. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.