PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-6051 IBM CVE debrief

IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 contain a denial-of-service vulnerability. An authenticated local attacker can trigger the condition by executing a specially crafted query when the database instance is configured with a small statement heap. The flaw stems from improper resource management (CWE-400), leading to uncontrolled resource consumption that crashes the database service. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates local attack vector, low attack complexity, low privileges required, no user interaction, and high availability impact. No public exploitation or ransomware campaign use has been reported. IBM has published remediation guidance.

Vendor
IBM
Product
Db2
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-28
Advisory published
2026-05-27
Advisory updated
2026-05-28

Who should care

Database administrators managing IBM Db2 deployments, security teams responsible for database infrastructure hardening, and organizations running multi-tenant Db2 environments where query privileges may be broadly distributed

Technical summary

The vulnerability exists in IBM Db2's query processing engine when handling complex queries under constrained statement heap memory conditions. The statement heap (STMTHEAP) is a database configuration parameter that controls memory allocation for SQL statement compilation. When set to a small value, certain crafted queries can exhaust available memory during compilation or execution, causing the database instance to terminate abnormally. This represents a resource exhaustion attack vector requiring local authenticated access. The vulnerability does not enable data confidentiality breaches or integrity modifications, but availability impact is rated high due to complete database service disruption.

Defensive priority

medium

Recommended defensive actions

  • Apply IBM Db2 fix packs or interim fixes as specified in IBM security bulletin
  • Review and adjust STMTHEAP database configuration parameter to ensure adequate allocation
  • Monitor database logs for abnormal query execution patterns or unexpected instance restarts
  • Restrict database query execution privileges to authorized users only
  • Validate query plans and resource consumption in non-production environments before deployment

Evidence notes

Vulnerability description and affected versions derived from NVD entry and IBM PSIRT reference. CWE-400 classification and CVSS vector confirmed via NVD source. No KEV listing present. Vendor attribution to IBM supported by reference domain candidate and PSIRT contact email.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-6051 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-6051

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-6051 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-6051

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.