IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 for Linux, UNIX, and Windows can be exploited by an authenticated user who sends a specially crafted query containing multiple subqueries. The flaw arises from improper neutralization of special elements in the data query logic, which can force the database engine into an unhandled state and result in a denial of service. If triggered, the problem can halt the Db2 service, causing an instant loss of availability for all clients that depend on the database.

The vulnerability affects IBM Db2 for Linux, UNIX, and Windows, including the Db2 Connect Server, across the specified version ranges. Specifically, any instance of Db2 11.5.0–11.5.9 or 12.1.0–12.1.4 that has not been upgraded to the fixed releases (11.5.9 or 12.1.4) remains at risk.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score is not available. The vulnerability is not listed in CISA KEV. Exploitability requires an authenticated connection to Db2, so an attacker must have valid credentials. Once authenticated, the attacker can supply the crafted query, which is likely to exploit the flaw because the database does not properly neutralize the special elements; this can terminate or freeze the Db2 instance, producing a denial of service. Because the flaw is not remote but requires server access, the attack vector is limited to environments that can reach the database and where credentials are compromised or misconfigured.