PatchSiren cyber security CVE debrief

CVE-2026-6051 IBM CVE debrief

IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 contain a denial-of-service vulnerability. An authenticated local attacker can trigger the condition by executing a specially crafted query when the database instance is configured with a small statement heap. The flaw stems from improper resource management (CWE-400), leading to uncontrolled resource consumption that crashes the database service. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates local attack vector, low attack complexity, low privileges required, no user interaction, and high availability impact. No public exploitation or ransomware campaign use has been reported. IBM has published remediation guidance.

Vendor: IBM
Product: Db2
CVSS: MEDIUM 5.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-27
Original CVE updated: 2026-05-27
Advisory published: 2026-05-27
Advisory updated: 2026-05-27

Who should care

Database administrators managing IBM Db2 deployments, security teams responsible for database infrastructure hardening, and organizations running multi-tenant Db2 environments where query privileges may be broadly distributed

Technical summary

The vulnerability exists in IBM Db2's query processing engine when handling complex queries under constrained statement heap memory conditions. The statement heap (STMTHEAP) is a database configuration parameter that controls memory allocation for SQL statement compilation. When set to a small value, certain crafted queries can exhaust available memory during compilation or execution, causing the database instance to terminate abnormally. This represents a resource exhaustion attack vector requiring local authenticated access. The vulnerability does not enable data confidentiality breaches or integrity modifications, but availability impact is rated high due to complete database service disruption.

Defensive priority

medium

Recommended defensive actions

Apply IBM Db2 fix packs or interim fixes as specified in IBM security bulletin
Review and adjust STMTHEAP database configuration parameter to ensure adequate allocation
Monitor database logs for abnormal query execution patterns or unexpected instance restarts
Restrict database query execution privileges to authorized users only
Validate query plans and resource consumption in non-production environments before deployment

Evidence notes

Vulnerability description and affected versions derived from NVD entry and IBM PSIRT reference. CWE-400 classification and CVSS vector confirmed via NVD source. No KEV listing present. Vendor attribution to IBM supported by reference domain candidate and PSIRT contact email.

Official resources

2026-05-27