CVE-2026-17463: IBM® Db2® could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption
DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption.
Other sources
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Db2to a version that resolves this vulnerability.Fixed in 11.5Patch Security Update #89304 - Upgrade
Upgrade
IBM Db2to a version that resolves this vulnerability.Fixed in 12.1.5Patch Security Update #89304 - Upgrade
Upgrade
IBM Db2to a version that resolves this vulnerability.Fixed in 12.1.5Patch Security Update #89304 or later
Event History
Frequently Asked Questions
Which deployments are affected?
Affected releases are IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 on Linux, UNIX, and Windows. This includes Db2 Connect Server.
What access does an attacker need?
An attacker must be able to reach the Db2 service remotely and authenticate with privileges. No user interaction is required.
What is the expected impact of exploitation?
Successful exploitation can consume uncontrolled resources and cause a denial of service. The provided information does not indicate confidentiality or integrity impact.