# CVE-2026-105466: IBM Db2 denial of service in XML column insertion

Source: https://junglewise.ai/threats/cve-2026-105466-ibm-db2-11-5-0-through-11-5-9-and-12-1-0-through-12-1-5-is  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-105466 · Severity: medium · CVSS 6.5 · Published 2026-10-12

IBM Db2 is a relational database system used for storing and managing enterprise data. An authenticated attacker can cause the database to become unavailable by inserting specially crafted data into tables with XML columns, disrupting business operations that depend on the database. The vulnerability requires authentication and specific table configuration but is easily triggered once those conditions are met.

Technologies: [IBM Db2](https://junglewise.ai/threats/technologies/db2). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2026-105466 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105466 being exploited in the wild.

**How severe is CVE-2026-105466?** Medium severity, with a CVSS score of 6.5, published 12 October 2026.

**Which products and versions are affected?** IBM Db2 11.5.0 through 11.5.9, 12.1.0 through 12.1.5.

**Is there a fix for CVE-2026-105466?** Yes: fixed in Db2 11.5.9 (Security Update #94236 or later), Db2 12.1.4 (Security Update #94722 or later), Db2 12.1.5 (Security Update #94858 or later). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105466 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-105466?** Check whether you run IBM Db2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Db2 11.5.9 (Security Update #94236 or later), Db2 12.1.4 (Security Update #94722 or later), Db2 12.1.5 (Security Update #94858 or later)

## Technical details

This is a resource exhaustion vulnerability (CWE-770) triggered when inserting into tables with XML columns under specific conditions. The attack requires authenticated database access and no user interaction; an authenticated attacker can craft INSERT statements to exhaust resources and crash the database service. A fix is available in security updates.

## Affected products

- IBM Db2 11.5.0 through 11.5.9, 12.1.0 through 12.1.5

## Timeline

- 2026-10-08: disclosed
- 2026-10-12: advisory

## References

- [https://www.ibm.com/support/pages/node/7291608](https://www.ibm.com/support/pages/node/7291608)

## Related threats

- [IBM Db2 denial of service in Materialized Query Table query processing](https://junglewise.ai/threats/cve-2026-113698-ibm-db2-11-5-0-through-11-5-9-and-12-1-0-through-12-1-5-is)
- [IBM Db2 denial of service in Materialized Query Table](https://junglewise.ai/threats/cve-2026-104332-ibm-db2-11-5-0-through-11-5-9-and-12-1-0-through-12-1-5-is)
- [IBM Db2 local privilege escalation in db2pd utility](https://junglewise.ai/threats/cve-2026-78404-ibm-db2-11-5-0-through-11-5-9-and-12-1-0-through-12-1-5-is)
- [IBM Db2 arbitrary library loading via CREATE WRAPPER](https://junglewise.ai/threats/cve-2026-18166-ibm-db2-11-5-0-through-11-5-9-and-12-1-0-through-12-1-5-for-linux)
- [IBM Db2 privilege escalation with db2locssh enabled](https://junglewise.ai/threats/cve-2026-105465-ibm-db2-11-5-0-through-11-5-9-and-12-1-0-through-12-1-5-is)