IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 contain a flaw that allows a specially crafted query involving a Materialized Query Table to trigger a denial‑of‑service condition, causing the database server to become unresponsive. This impact is classified as moderate severity denial of service (CWE‑121).

Affected systems are IBM Db2 releases 11.5.0 to 11.5.9 and 12.1.0 to 12.1.5. IBM provides security updates containing the interim fix for these releases. Customers running any vulnerable level can download the update from Fix Central; for version 11.5 the relevant update level is 11.5.9 and for 12.1 it is 12.1.5 or later. The patches are available under Security Update #94858 or later.

The CVSS score of 6.5 indicates moderate risk, while there is no EPSS score available to gauge exploitation probability, and the flaw is not listed in CISA’s KEV catalog. The likely attack vector is an attacker who can submit a query to the affected Db2 instance; this inference is based on the vulnerability description. Given the denial of service nature, the impact is limited to availability; confidentiality and integrity are not affected.