PatchSiren cyber security CVE debrief

CVE-2026-6052 IBM CVE debrief

IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 are vulnerable to memory exhaustion when executing specific queries against Multi-Dimensional Clustering (MDC) tables. The vulnerability, classified as CWE-400 (Uncontrolled Resource Consumption), allows an authenticated attacker with low privileges to cause a denial of service condition by triggering memory depletion through network-accessible query execution. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates network attack vector, low attack complexity, low privileges required, no user interaction, and high availability impact. IBM has published a security bulletin addressing this issue.

Vendor: IBM
Product: Db2
CVSS: MEDIUM 6.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-27
Original CVE updated: 2026-05-27
Advisory published: 2026-05-27
Advisory updated: 2026-05-27

Who should care

Database administrators managing IBM Db2 11.5.x or 12.1.x deployments; security teams responsible for availability of critical database infrastructure; application owners whose workloads utilize MDC tables for analytical or operational workloads

Technical summary

The vulnerability exists in IBM Db2's query processing engine when handling queries against Multi-Dimensional Clustering (MDC) tables. MDC is a Db2 feature that organizes data physically on disk according to specified dimensions to improve query performance. Under certain query conditions, the query optimizer or execution engine may allocate excessive memory without proper bounds checking, leading to memory exhaustion. The attack requires authenticated network access with low privileges, making it exploitable by any valid database user. The high availability impact stems from potential database instance termination or severe performance degradation when system memory is depleted. No confidentiality or integrity impact is indicated in the CVSS scoring.

Defensive priority

medium

Recommended defensive actions

Review IBM security bulletin for available patches or fix packs for affected Db2 versions 11.5.x and 12.1.x
Assess database query patterns involving MDC tables for potential memory-intensive operations
Implement query resource limits and memory thresholds for Db2 workloads where patches are not immediately available
Monitor database memory utilization and set alerts for abnormal consumption patterns
Restrict database access to authenticated users with minimal required privileges per principle of least privilege

Evidence notes

Vulnerability description sourced from NVD official record. IBM PSIRT reference confirms vendor acknowledgment. CVSS 3.1 vector and CWE-400 classification from NVD enrichment data. Affected version ranges explicitly stated in CVE description.

Official resources

2026-05-27