A trap is triggered during the compilation of specially crafted SQL statements that contain subqueries, causing the Db2 engine to enter a non‑responsive state and resulting in a denial of service. The weakness is classified as CWE‑835, an infinite loop or trap condition, and leads to loss of availability for any application that depends on the affected Db2 instance.

IBM Db2 database engines are affected. Versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 on any modpack level are vulnerable unless the interim fixes are applied.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1 % suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires submitting a crafted SQL statement that contains subqueries; if the statement is compiled, the trap activates and the database becomes unresponsive until manual intervention or a restart. Based on the description, the likely attack vector is through any interface that accepts SQL commands, such as remote client connections or embedded application queries.