The vulnerability in IBM Db2 versions 11.5.x and 12.1.x allows an authenticated user to trigger a denial of service by causing improper neutralization of special elements in data query logic when certain configurations are present. This flaw can disrupt database operations, potentially rendering the database unavailable for legitimate users. The weakness is catalogued as CWE‑1284, indicating a flaw in neutralization of input during query processing.

Affected are IBM Db2 on Linux, UNIX, and Windows, including the Db2 Connect Server, for product lines 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3. All installations of these releases that use the specified configuration are vulnerable. The specific affected configuration is the registry variable DB2_EXTENDED_OPTIMIZATION=NLJN_OFLOW.

The CVSS score of 5.3 reflects a moderate impact with limited impact on confidentiality or integrity, but with the potential to disrupt services. The EPSS score is not published, and the issue is not listed in the CISA KEV catalog, suggesting a lower likelihood of active exploitation in the wild. The vulnerability requires authenticated access and a particular configuration, implying a limited attacker scope. Attackers would need the ability to execute queries against the database, typically through legitimate credentials, making the vulnerability less attractive for widespread attacks but still relevant for environments with unmitigated configurations.