Vulnerability-Lookup

CVE-2026-6052 (GCVE-0-2026-6052)

Vulnerability from cvelistv5 – Published: 2026-05-27 13:09 – Updated: 2026-05-27 15:22

Title

IBM® Db2® is vulnerable to running out of memory when executing certain queries with MDC tables

Summary

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to running out of memory when executing certain queries with MDC tables.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

ibm

References

1 reference

URL	Tags
https://www.ibm.com/support/pages/node/7273557	vendor-advisorypatch

Impacted products

1 product

Vendor	Product	Version
IBM	Db2	Affected: 11.5.0 , ≤ 11.5.9 (semver) Affected: 12.1.0 , ≤ 12.1.4 (semver) cpe:2.3:a:ibm:db2:11.5.0:::::::* cpe:2.3:a:ibm:db2:11.5.9:::::::* cpe:2.3:a:ibm:db2:12.1.0:::::::* cpe:2.3:a:ibm:db2:12.1.4:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-6052",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-27T15:21:52.352065Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-27T15:22:19.791Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:db2:12.1.4:*:*:*:*:*:*:*"
          ],
          "product": "Db2",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "11.5.9",
              "status": "affected",
              "version": "11.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.1.4",
              "status": "affected",
              "version": "12.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to running out of memory when executing certain queries with MDC tables.\u003c/p\u003e"
            }
          ],
          "value": "IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to running out of memory when executing certain queries with MDC tables."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-27T13:09:29.770Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7273557"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eCustomers running any vulnerable affected level of an affected Program, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V11.5.9, and V12.1.4. They can be applied to any affected level of the appropriate release to remediate this vulnerability.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003eRelease\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eFixed in mod pack\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eAPAR\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eDownload URL\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eV11.5\u003c/td\u003e\u003ctd\u003eTBD\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://www.ibm.com/mysupport/s/defect/aCIgJ000000BcEr/dt465726\" rel=\"nofollow\"\u003eDT465726\u003c/a\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003eSpecial Build #81937 or later for V11.5.9 available at this link:\u003cbr\u003e\u003ca href=\"https://www.ibm.com/support/pages/node/7087189\" rel=\"noopener noreferrer nofollow\"\u003ehttps://www.ibm.com/support/pages/node/7087189\u003c/a\u003e\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003eV12.1\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003eTBD\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e\u003ca href=\"https://www.ibm.com/mysupport/s/defect/aCIgJ000000BcEr/dt465726\" rel=\"nofollow\"\u003eDT465726\u003c/a\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003eSpecial Build #83501 or later for V12.1.4 available at this link:\u003cbr\u003e\u003ca href=\"https://www.ibm.com/support/pages/node/7267513\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/pages/node/7267513\u003c/a\u003e\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eIBM does not disclose key Db2 functionality nor replication steps for a vulnerability to avoid providing too much information to any potential malicious attacker. IBM does not want to enable a malicious attacker with sufficient knowledge to craft an exploit of the vulnerability.\u003c/p\u003e"
            }
          ],
          "value": "Customers running any vulnerable affected level of an affected Program, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V11.5.9, and V12.1.4. They can be applied to any affected level of the appropriate release to remediate this vulnerability.\n\n\n\n\n\nReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 \n\n\n\nV12.1\n\n\n\n\n\n\n\nTBD\n\n\n\n\n\n\n\n https://www.ibm.com/support/pages/node/7267513 \n\n\n\n\n\n\n\n\n\nIBM does not disclose key Db2 functionality nor replication steps for a vulnerability to avoid providing too much information to any potential malicious attacker. IBM does not want to enable a malicious attacker with sufficient knowledge to craft an exploit of the vulnerability."
        }
      ],
      "title": "IBM\u00ae Db2\u00ae is vulnerable to running out of memory when executing certain queries with MDC tables",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eDo not use Multi-Clustering-Dimensional (MDC) tables\u003c/p\u003e"
            }
          ],
          "value": "Do not use Multi-Clustering-Dimensional (MDC) tables"
        }
      ],
      "x_generator": {
        "engine": "ibm-cvegen"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2026-6052",
    "datePublished": "2026-05-27T13:09:29.770Z",
    "dateReserved": "2026-04-09T22:08:53.174Z",
    "dateUpdated": "2026-05-27T15:22:19.791Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-6052",
      "date": "2026-05-29",
      "epss": "0.00042",
      "percentile": "0.13088"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-6052\",\"sourceIdentifier\":\"psirt@us.ibm.com\",\"published\":\"2026-05-27T14:17:34.513\",\"lastModified\":\"2026-05-28T15:51:31.187\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to running out of memory when executing certain queries with MDC tables.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@us.ibm.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-400\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:db2:*:*:*:*:-:*:*:*\",\"versionStartIncluding\":\"11.5.0\",\"versionEndIncluding\":\"11.5.9\",\"matchCriteriaId\":\"210F96C9-B756-434F-8F82-CC7834829F43\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:db2:*:*:*:*:-:*:*:*\",\"versionStartIncluding\":\"12.1.0\",\"versionEndIncluding\":\"12.1.4\",\"matchCriteriaId\":\"3E4312C4-5E1B-44C5-915B-A9E3483506BF\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:ibm:aix:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E492C463-D76E-49B7-A4D4-3B499E422D89\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:ibm:linux_on_ibm_z:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B955E472-47E3-4C32-847B-F6BB05594BA3\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"703AF700-7A70-47E2-BC3A-7FD03B3CA9C1\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A2572D17-1DE6-457B-99CC-64AFD54487EA\"}]}]}],\"references\":[{\"url\":\"https://www.ibm.com/support/pages/node/7273557\",\"source\":\"psirt@us.ibm.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-6052\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-27T15:21:52.352065Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-400\", \"description\": \"CWE-400 Uncontrolled Resource Consumption\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-27T15:21:13.164Z\"}}], \"cna\": {\"title\": \"IBM\\u00ae Db2\\u00ae is vulnerable to running out of memory when executing certain queries with MDC tables\", \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:db2:12.1.4:*:*:*:*:*:*:*\"], \"vendor\": \"IBM\", \"product\": \"Db2\", \"versions\": [{\"status\": \"affected\", \"version\": \"11.5.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"11.5.9\"}, {\"status\": \"affected\", \"version\": \"12.1.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"12.1.4\"}]}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Customers running any vulnerable affected level of an affected Program, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V11.5.9, and V12.1.4. They can be applied to any affected level of the appropriate release to remediate this vulnerability.\\n\\n\\n\\n\\n\\nReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 \\n\\n\\n\\nV12.1\\n\\n\\n\\n\\n\\n\\n\\nTBD\\n\\n\\n\\n\\n\\n\\n\\n https://www.ibm.com/support/pages/node/7267513 \\n\\n\\n\\n\\n\\n\\n\\n\\n\\nIBM does not disclose key Db2 functionality nor replication steps for a vulnerability to avoid providing too much information to any potential malicious attacker. IBM does not want to enable a malicious attacker with sufficient knowledge to craft an exploit of the vulnerability.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eCustomers running any vulnerable affected level of an affected Program, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V11.5.9, and V12.1.4. They can be applied to any affected level of the appropriate release to remediate this vulnerability.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003eRelease\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eFixed in mod pack\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eAPAR\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eDownload URL\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eV11.5\u003c/td\u003e\u003ctd\u003eTBD\u003c/td\u003e\u003ctd\u003e\u003ca href=\\\"https://www.ibm.com/mysupport/s/defect/aCIgJ000000BcEr/dt465726\\\" rel=\\\"nofollow\\\"\u003eDT465726\u003c/a\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003eSpecial Build #81937 or later for V11.5.9 available at this link:\u003cbr\u003e\u003ca href=\\\"https://www.ibm.com/support/pages/node/7087189\\\" rel=\\\"noopener noreferrer nofollow\\\"\u003ehttps://www.ibm.com/support/pages/node/7087189\u003c/a\u003e\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003eV12.1\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003eTBD\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e\u003ca href=\\\"https://www.ibm.com/mysupport/s/defect/aCIgJ000000BcEr/dt465726\\\" rel=\\\"nofollow\\\"\u003eDT465726\u003c/a\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003eSpecial Build #83501 or later for V12.1.4 available at this link:\u003cbr\u003e\u003ca href=\\\"https://www.ibm.com/support/pages/node/7267513\\\" rel=\\\"nofollow\\\"\u003ehttps://www.ibm.com/support/pages/node/7267513\u003c/a\u003e\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eIBM does not disclose key Db2 functionality nor replication steps for a vulnerability to avoid providing too much information to any potential malicious attacker. IBM does not want to enable a malicious attacker with sufficient knowledge to craft an exploit of the vulnerability.\u003c/p\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://www.ibm.com/support/pages/node/7273557\", \"tags\": [\"vendor-advisory\", \"patch\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Do not use Multi-Clustering-Dimensional (MDC) tables\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eDo not use Multi-Clustering-Dimensional (MDC) tables\u003c/p\u003e\", \"base64\": false}]}], \"x_generator\": {\"engine\": \"ibm-cvegen\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to running out of memory when executing certain queries with MDC tables.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eIBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to running out of memory when executing certain queries with MDC tables.\u003c/p\u003e\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"shortName\": \"ibm\", \"dateUpdated\": \"2026-05-27T13:09:29.770Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-6052\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-27T15:22:19.791Z\", \"dateReserved\": \"2026-04-09T22:08:53.174Z\", \"assignerOrgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"datePublished\": \"2026-05-27T13:09:29.770Z\", \"assignerShortName\": \"ibm\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-6052

Vulnerability from fkie_nvd - Published: 2026-05-27 14:17 - Updated: 2026-05-28 15:51

Severity

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to running out of memory when executing certain queries with MDC tables.

References

	URL	Tags
	psirt@us.ibm.com	https://www.ibm.com/support/pages/node/7273557	Vendor Advisory

Impacted products

Vendor	Product	Version
ibm	db2	*
ibm	db2	*
ibm	aix	-
ibm	linux_on_ibm_z	-
linux	linux_kernel	-
microsoft	windows	-

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:db2:*:*:*:*:-:*:*:*",
              "matchCriteriaId": "210F96C9-B756-434F-8F82-CC7834829F43",
              "versionEndIncluding": "11.5.9",
              "versionStartIncluding": "11.5.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:db2:*:*:*:*:-:*:*:*",
              "matchCriteriaId": "3E4312C4-5E1B-44C5-915B-A9E3483506BF",
              "versionEndIncluding": "12.1.4",
              "versionStartIncluding": "12.1.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ibm:aix:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E492C463-D76E-49B7-A4D4-3B499E422D89",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:o:ibm:linux_on_ibm_z:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B955E472-47E3-4C32-847B-F6BB05594BA3",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to running out of memory when executing certain queries with MDC tables."
    }
  ],
  "id": "CVE-2026-6052",
  "lastModified": "2026-05-28T15:51:31.187",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "psirt@us.ibm.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2026-05-27T14:17:34.513",
  "references": [
    {
      "source": "psirt@us.ibm.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.ibm.com/support/pages/node/7273557"
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

GHSA-GPJV-6R8H-VP58

Vulnerability from github – Published: 2026-05-27 15:33 – Updated: 2026-05-27 15:33

Details

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to running out of memory when executing certain queries with MDC tables.

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-6052"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-27T14:17:34Z",
    "severity": "MODERATE"
  },
  "details": "IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to running out of memory when executing certain queries with MDC tables.",
  "id": "GHSA-gpjv-6r8h-vp58",
  "modified": "2026-05-27T15:33:24Z",
  "published": "2026-05-27T15:33:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6052"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7273557"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

WID-SEC-W-2026-1646

Vulnerability from csaf_certbund - Published: 2026-05-21 22:00 - Updated: 2026-05-27 22:00

Summary

IBM DB2: Mehrere Schwachstellen

Severity

Mittel

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: IBM DB2 ist ein relationales Datenbanksystem (RDBS) von IBM.

Angriff: Ein entfernter, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in IBM DB2 ausnutzen, um Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen oder einen Denial-of-Service-Zustand zu verursachen.

Betroffene Betriebssysteme: - Sonstiges - UNIX - Windows

CVE-2025-13755

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
IBM DB2 V12.1 <Special Build 83501 IBM / DB2		V12.1 <Special Build 83501
IBM DB2 V11.5 <Special Build 81937 IBM / DB2		V11.5 <Special Build 81937

CVE-2026-1718

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
IBM DB2 V12.1 <Special Build 83501 IBM / DB2		V12.1 <Special Build 83501
IBM DB2 V11.5 <Special Build 81937 IBM / DB2		V11.5 <Special Build 81937

CVE-2026-6051

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
IBM DB2 V12.1 <Special Build 83501 IBM / DB2		V12.1 <Special Build 83501
IBM DB2 V11.5 <Special Build 81937 IBM / DB2		V11.5 <Special Build 81937

CVE-2026-6052

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
IBM DB2 V12.1 <Special Build 83501 IBM / DB2		V12.1 <Special Build 83501
IBM DB2 V11.5 <Special Build 81937 IBM / DB2		V11.5 <Special Build 81937

CVE-2026-6053

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
IBM DB2 V12.1 <Special Build 83501 IBM / DB2		V12.1 <Special Build 83501
IBM DB2 V11.5 <Special Build 81937 IBM / DB2		V11.5 <Special Build 81937

CVE-2026-6938

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
IBM DB2 V12.1 <Special Build 83501 IBM / DB2		V12.1 <Special Build 83501
IBM DB2 V11.5 <Special Build 81937 IBM / DB2		V11.5 <Special Build 81937

References

8 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://www.ibm.com/support/pages/node/7273554	external
https://www.ibm.com/support/pages/node/7273555	external
https://www.ibm.com/support/pages/node/7273558	external
https://www.ibm.com/support/pages/node/7273557	external
https://www.ibm.com/support/pages/node/7273556	external
https://www.ibm.com/support/pages/node/7273559	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "IBM DB2 ist ein relationales Datenbanksystem (RDBS) von IBM.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in IBM DB2 ausnutzen, um Informationen offenzulegen, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand zu verursachen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-1646 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1646.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-1646 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1646"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7273554 vom 2026-05-21",
        "url": "https://www.ibm.com/support/pages/node/7273554"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7273555 vom 2026-05-21",
        "url": "https://www.ibm.com/support/pages/node/7273555"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7273558 vom 2026-05-21",
        "url": "https://www.ibm.com/support/pages/node/7273558"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7273557 vom 2026-05-21",
        "url": "https://www.ibm.com/support/pages/node/7273557"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7273556 vom 2026-05-21",
        "url": "https://www.ibm.com/support/pages/node/7273556"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7273559 vom 2026-05-21",
        "url": "https://www.ibm.com/support/pages/node/7273559"
      }
    ],
    "source_lang": "en-US",
    "title": "IBM DB2: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-05-27T22:00:00.000+00:00",
      "generator": {
        "date": "2026-05-28T06:45:42.007+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-1646",
      "initial_release_date": "2026-05-21T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-05-21T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-05-26T22:00:00.000+00:00",
          "number": "2",
          "summary": "Referenz(en) aufgenommen: EUVD-2025-209933"
        },
        {
          "date": "2026-05-27T22:00:00.000+00:00",
          "number": "3",
          "summary": "Referenz(en) aufgenommen: EUVD-2026-32492, EUVD-2026-32490, EUVD-2026-32488, EUVD-2026-32489, EUVD-2026-32266"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "V11.5 \u003cSpecial Build 81937",
                "product": {
                  "name": "IBM DB2 V11.5 \u003cSpecial Build 81937",
                  "product_id": "T054499"
                }
              },
              {
                "category": "product_version",
                "name": "V11.5 Special Build 81937",
                "product": {
                  "name": "IBM DB2 V11.5 Special Build 81937",
                  "product_id": "T054499-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:db2:v11.5__special_build_81937"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "V12.1 \u003cSpecial Build 83501",
                "product": {
                  "name": "IBM DB2 V12.1 \u003cSpecial Build 83501",
                  "product_id": "T054500"
                }
              },
              {
                "category": "product_version",
                "name": "V12.1 Special Build 83501",
                "product": {
                  "name": "IBM DB2 V12.1 Special Build 83501",
                  "product_id": "T054500-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:db2:v12.1__special_build_83501"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "DB2"
          }
        ],
        "category": "vendor",
        "name": "IBM"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-13755",
      "product_status": {
        "known_affected": [
          "T054500",
          "T054499"
        ]
      },
      "release_date": "2026-05-21T22:00:00.000+00:00",
      "title": "CVE-2025-13755"
    },
    {
      "cve": "CVE-2026-1718",
      "product_status": {
        "known_affected": [
          "T054500",
          "T054499"
        ]
      },
      "release_date": "2026-05-21T22:00:00.000+00:00",
      "title": "CVE-2026-1718"
    },
    {
      "cve": "CVE-2026-6051",
      "product_status": {
        "known_affected": [
          "T054500",
          "T054499"
        ]
      },
      "release_date": "2026-05-21T22:00:00.000+00:00",
      "title": "CVE-2026-6051"
    },
    {
      "cve": "CVE-2026-6052",
      "product_status": {
        "known_affected": [
          "T054500",
          "T054499"
        ]
      },
      "release_date": "2026-05-21T22:00:00.000+00:00",
      "title": "CVE-2026-6052"
    },
    {
      "cve": "CVE-2026-6053",
      "product_status": {
        "known_affected": [
          "T054500",
          "T054499"
        ]
      },
      "release_date": "2026-05-21T22:00:00.000+00:00",
      "title": "CVE-2026-6053"
    },
    {
      "cve": "CVE-2026-6938",
      "product_status": {
        "known_affected": [
          "T054500",
          "T054499"
        ]
      },
      "release_date": "2026-05-21T22:00:00.000+00:00",
      "title": "CVE-2026-6938"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-6052 (GCVE-0-2026-6052)

FKIE_CVE-2026-6052

GHSA-GPJV-6R8H-VP58

WID-SEC-W-2026-1646

Tags

Sightings

Nomenclature