CVE-2026-6051

Vulnerability

IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 (all editions, all platforms) are vulnerable to a denial of service when a user executes a specially crafted query while the statement heap is configured to a small size [1]. The vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption) [1].

Exploitation

To exploit, an attacker must have a valid local user account (privilege level: Low, per CVSS vector) and be able to connect to the database [1]. The attacker then submits a crafted query that, due to the small statement heap, triggers uncontrolled resource consumption, leading to denial of service. No user interaction beyond the query execution is required [1].

Impact

Successful exploitation results in a denial of service condition affecting the database server's availability. The vulnerability does not impact confidentiality or integrity (C:N/I:N/A:H) [1]. The attack is local with low complexity, meaning an authenticated user can cause the database to become unresponsive.

Mitigation

IBM has released special builds containing interim fixes for the affected releases: special build #81937 or later for V11.5.9, and special build #83501 or later for V12.1.4, available from IBM Fix Central via the URLs provided in the advisory [1]. Earlier unsupported releases (10.1, 9.7, etc.) are also potentially affected but no fixes are provided for those versions [1].