IBM Db2 Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4. The issue arises when a specially crafted query is executed using a small statement heap, leading to uncontrolled resource consumption.

Impact

Exploitation of this vulnerability causes a denial-of-service condition, where the database becomes unresponsive or unavailable.

Remediation

Users can increase the statement heap by setting a larger STMTHEAP value. Alternatively, the optimization level can be reduced to 0 by appending an optimizer guideline to the query. Customers running Db2 V11.5 or V12.1 can download a special build containing the interim fix from Fix Central.