CVE-2026-105466: IBM® Db2® is vulnerable to a denial of service when inserting into a table with XML columns under specific conditions

Q: Which Db2 versions are affected?

IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 are affected.

Q: What level of access does an attacker need?

The CVSS vector indicates network-reachable exploitation with low privileges and no user interaction. The specific insertion conditions needed to trigger the issue are not provided.

Q: What is the expected security impact?

The reported impact is denial of service, affecting availability. The CVSS vector indicates no confidentiality or integrity impact.

Published Oct 8, 2026

Updated

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when inserting into a table with XML columns under specific conditions.

Other sources

IBM Db2 is vulnerable to a denial of service when inserting into a table with XML columns under specific conditions.

— IBM

Affected Software

3 affected components

IBM DB2>=11.5.0<=11.5.9, >=12.1.0<=12.1.5

IBM IBM® Db2®<=11.5.0 - 11.5.9

IBM IBM® Db2®<=12.1.0 - 12.1.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM Db2 to a version that resolves this vulnerability.
Patch Security Update #94236
Upgrade
Upgrade IBM Db2 to a version that resolves this vulnerability.
Patch Security Update #94722
Upgrade
Upgrade IBM Db2 to a version that resolves this vulnerability.
Patch Security Update #94858

Event History

Oct 8, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Oct 12, 2026

CVE Published

via MITRE·06:42 PM

Data Sourced

via MITRE·06:42 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7291608

Frequently Asked Questions

Which Db2 versions are affected?

IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 are affected.

What level of access does an attacker need?

The CVSS vector indicates network-reachable exploitation with low privileges and no user interaction. The specific insertion conditions needed to trigger the issue are not provided.

What is the expected security impact?

The reported impact is denial of service, affecting availability. The CVSS vector indicates no confidentiality or integrity impact.

CVE-2026-105466: IBM® Db2® is vulnerable to a denial of service when inserting into a table with XML columns under specific conditions

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Which Db2 versions are affected?

What level of access does an attacker need?

What is the expected security impact?

Company

Resources

Contact

Frequently Asked Questions

Which Db2 versions are affected?

What level of access does an attacker need?

What is the expected security impact?