IBM Db2 versions 11.5.0 to 11.5.9 and 12.1.0 to 12.1.4 suffer a denial‑of‑service vulnerability that can be triggered by a specially crafted SQL query executed under an autonomous transaction. The flaw causes the database engine to exhaust resources, preventing normal query processing and potentially halting the database instance. The weakness corresponds to CWE-770—resource exhaustion. The impact is loss of availability for affected databases and services that rely on them.

IBM Db2 for Linux, Unix, and Windows is affected by this vulnerability in all releases from 11.5.0 through 11.5.9 and from 12.1.0 through 12.1.4. The interim fix for these releases is contained in the special builds for 11.5.9 and 12.1.4, which can be applied to any earlier sub‑release within those major versions.

The CVSS v3.1 score of 7.1 indicates a high impact and medium exploitation difficulty. No EPSS score is currently available, and the vulnerability is not listed in the CISA KEV catalog. The exploit requires the ability to submit a crafted query to a Db2 instance with autonomous transactions enabled, which typically implies at least application‑level or database user privileges. In practice, this means that internal users or compromised credentials with such privileges could trigger a denial‑of‑service, stressing the importance of timely patching.