CVE-2026-17463

IBM® Db2® could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption

View on CVE.org

Published Sep 14, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption.

Analysis

Technical impact

IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 for Linux, Unix and Windows can allow a remote authenticated attacker to trigger uncontrolled resource consumption, leading to a denial of service. The weakness is a lack of resource use control in the database server, identified as CWE-400. An attacker who can log in can cause the database to become unavailable to legitimate users.

Affected Systems

Affected products include IBM Db2 11.5.0 to 11.5.9 and 12.1.0 to 12.1.5, covering Linux, Unix and Windows platforms and the DB2 Connect Server component.

Risk and Exploitability

The CVSS score of 6.5 indicates a medium severity. The EPSS score of 0.0049 (less than 1%) shows a very low but nonzero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires remote authentication, so only accounts with valid credentials can trigger the denial of service attack.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

IBM

Db2

affected

Version	Status	Constraints
`11.5.0`	affected	≤ 11.5.9
`12.1.0`	affected	≤ 12.1.5

No data.

Vendor Product Versions

Ibm

Db2

Version	Status	Scheme	Platform
`[11.5.0,11.5.9]`	affected	semver	—
`[12.1.0,12.1.5]`	affected	semver	—

Remediation

Vendor Solution

Customers running any vulnerable affected level of an affected Program, V11.5, and V12.1, can download the security update containing the interim fix for this issue from Fix Central. These security updates are available based on the most recent level for each impacted release: V11.5.9, V12.1.4, and V12.1.5. They can be applied to any affected level of the appropriate release to remediate this vulnerability. ReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 V12.1TBD https://www.ibm.com/support/pages/node/7267513 Security Update #89304 or later for V12.1.5 available at this link: https://www.ibm.com/support/pages/node/7282633 IBM does not disclose key Db2 functionality nor replication steps for a vulnerability to avoid providing too much information to any potential malicious attacker. IBM does not want to enable a malicious attacker with sufficient knowledge to craft an exploit of the vulnerability.

OpenCVE Recommended Actions

Download and install the IBM security update for the affected release from Fix Central (for example, Security Update #89304 or later for V12.1.5).
Configure DB2 resource limits—such as constraining potential excess consumption.
Continuously monitor system performance metrics and logs for abnormal memory or CPU usage that may indicate an attempted denial of service attack.

Generated by OpenCVE AI on September 20, 2026 at 23:21 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.490% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://www.ibm.com/support/pages/node/7286983

History

Sep 14, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 14, 2026 9:00 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption.
Title		IBM® Db2® could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption
First Time appeared		Ibm Ibm db2
Weaknesses		CWE-400
CPEs		cpe:2.3:a:ibm:db2:11.5.0:::::::* cpe:2.3:a:ibm:db2:11.5.9:::::::* cpe:2.3:a:ibm:db2:12.1.0:::::::* cpe:2.3:a:ibm:db2:12.1.5:::::::*
Vendors & Products		Ibm Ibm db2
References		https://www.ibm.com/support/pages/node/7286983
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`