Executive brief
IBM Db2 is a database management system used to store and manage large volumes of corporate data. A vulnerability has been identified where an attacker with basic database access can send a specifically crafted query that causes the system to crash or become unresponsive. This results in a denial of service, potentially disrupting business operations and preventing legitimate users from accessing critical data.
Technical details
IBM Db2 (specifically on Linux) is vulnerable to a denial of service due to improper resource management (CWE-770) when processing autonomous transactions. An authenticated attacker with network access can execute a specially crafted SQL query against an AUTONOMOUS procedure to trigger a system crash or resource exhaustion. The vulnerability affects versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 on Linux platforms; Unix and Windows are reportedly not affected. IBM has released special builds (interim fixes) to address this issue, and a potential mitigation involves removing the AUTONOMOUS keyword from procedure definitions.
Affected products
- IBM Db2 Server 11.5.0 - 11.5.9, 12.1.0 - 12.1.4
Timeline
- 2026-05-21: advisory: Initial IBM publication
- 2026-05-27: disclosed: NVD publication