IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 allow a denial of service when inserting data into tables that contain XML columns under specific conditions. The flaw results from insufficient resource allocation when processing certain XML payloads, causing the database engine to consume excessive resources or become unresponsive. An attacker who can influence the input to an XML column could force the database into a state where it refuses new requests, leading to service interruption for applications relying on that Db2 instance.

The affected products are IBM Db2 for AIX and Linux operating systems. Versions ranging from 11.5.0 up to 11.5.9 and from 12.1.0 up to 12.1.5 are impacted. IBM provides security updates for these releases that can be applied regardless of the specific level within the major release, including updates #94236 for 11.5.9, #94722 for 12.1.4, and #94858 for 12.1.5.

The CVSS score is 6.5, indicating a moderate severity. The EPSS score is not available, and this vulnerability is not listed in the CISA KEV catalog. The attack requires the ability to insert data into XML columns, so it usually demands some level of application or user access to the database. If an attacker can supply malicious XML input, they can trigger the denial of service by exhausting resources or causing the engine to hang.