CVE-2026-105466
6.5MediumPublished 12 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-770
Impact
Authenticated users can crash the database service, causing a complete denial of service. Attackers only need low-privilege network access to perform inserts into target tables.
Root cause
Improper resource allocation handling occurs when inserting data into tables containing XML columns under specific conditions.
Affected systems
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Upgrade to fixed versions above 11.5.9 or 12.1.5 per the vendor advisory. If you cannot patch immediately, restrict insert permissions to tables with XML columns or block untrusted authenticated users from writing to them.
$ db2levelAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when inserting into a table with XML columns under specific conditions.