Vulnerability-Lookup

CNVD-2026-23403

Vulnerability from cnvd - Published: 2026-06-08

Title

IBM Db2拒绝服务漏洞（CNVD-2026-23403）

Description

IBM Db2是一款关系型数据库管理系统，主要用于数据存储、查询和管理。 IBM Db2存在拒绝服务漏洞。该漏洞源于执行特制的小语句堆查询时未能正确处理，攻击者可利用该漏洞导致服务异常终止。

Severity

中

Patch Name

IBM Db2拒绝服务漏洞（CNVD-2026-23403）的补丁

Patch Description

IBM Db2是一款关系型数据库管理系统，主要用于数据存储、查询和管理。 IBM Db2存在拒绝服务漏洞。该漏洞源于执行特制的小语句堆查询时未能正确处理，攻击者可利用该漏洞导致服务异常终止。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://www.ibm.com/support/pages/node/7273558

Reference

https://nvd.nist.gov/vuln/detail/CVE-2026-6051

Impacted products

Name
['IBM DB2 >=11.5.0，<=11.5.9', 'IBM DB2 >=12.1.0，<=12.1.4']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2026-6051",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-6051"
    }
  },
  "description": "IBM Db2\u662f\u4e00\u6b3e\u5173\u7cfb\u578b\u6570\u636e\u5e93\u7ba1\u7406\u7cfb\u7edf\uff0c\u4e3b\u8981\u7528\u4e8e\u6570\u636e\u5b58\u50a8\u3001\u67e5\u8be2\u548c\u7ba1\u7406\u3002\n\nIBM Db2\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u6267\u884c\u7279\u5236\u7684\u5c0f\u8bed\u53e5\u5806\u67e5\u8be2\u65f6\u672a\u80fd\u6b63\u786e\u5904\u7406\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u670d\u52a1\u5f02\u5e38\u7ec8\u6b62\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.ibm.com/support/pages/node/7273558",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2026-23403",
  "openTime": "2026-06-08",
  "patchDescription": "IBM Db2\u662f\u4e00\u6b3e\u5173\u7cfb\u578b\u6570\u636e\u5e93\u7ba1\u7406\u7cfb\u7edf\uff0c\u4e3b\u8981\u7528\u4e8e\u6570\u636e\u5b58\u50a8\u3001\u67e5\u8be2\u548c\u7ba1\u7406\u3002\r\n\r\nIBM Db2\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u6267\u884c\u7279\u5236\u7684\u5c0f\u8bed\u53e5\u5806\u67e5\u8be2\u65f6\u672a\u80fd\u6b63\u786e\u5904\u7406\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u670d\u52a1\u5f02\u5e38\u7ec8\u6b62\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "IBM Db2\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff08CNVD-2026-23403\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "IBM DB2 \u003e=11.5.0\uff0c\u003c=11.5.9",
      "IBM DB2 \u003e=12.1.0\uff0c\u003c=12.1.4"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2026-6051",
  "serverity": "\u4e2d",
  "submitTime": "2026-05-28",
  "title": "IBM Db2\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff08CNVD-2026-23403\uff09"
}

CVE-2026-6051 (GCVE-0-2026-6051)

Vulnerability from cvelistv5 – Published: 2026-05-27 13:07 – Updated: 2026-05-27 14:41

Title

IBM® Db2® is vulnerable to a denial of service when executing a specially crafted query with a small statement heap

Summary

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a denial of service when executing a specially crafted query with a small statement heap.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

ibm

References

1 reference

URL	Tags
https://www.ibm.com/support/pages/node/7273558	vendor-advisorypatch

Impacted products

1 product

Vendor	Product	Version
IBM	Db2	Affected: 11.5.0 , ≤ 11.5.9 (semver) Affected: 12.1.0 , ≤ 12.1.4 (semver) cpe:2.3:a:ibm:db2:11.5.0:::::::* cpe:2.3:a:ibm:db2:11.5.9:::::::* cpe:2.3:a:ibm:db2:12.1.0:::::::* cpe:2.3:a:ibm:db2:12.1.4:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-6051",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-27T14:38:57.077391Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-27T14:41:58.407Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:db2:12.1.4:*:*:*:*:*:*:*"
          ],
          "product": "Db2",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "11.5.9",
              "status": "affected",
              "version": "11.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.1.4",
              "status": "affected",
              "version": "12.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a denial of service when executing a specially crafted query with a small statement heap.\u003c/p\u003e"
            }
          ],
          "value": "IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a denial of service when executing a specially crafted query with a small statement heap."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400 Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-27T13:07:47.761Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7273558"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eCustomers running any vulnerable affected level of an affected Program, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V11.5.9, and V12.1.4. They can be applied to any affected level of the appropriate release to remediate this vulnerability.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003eRelease\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eFixed in mod pack\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eAPAR\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eDownload URL\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eV11.5\u003c/td\u003e\u003ctd\u003eTBD\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://www.ibm.com/mysupport/s/defect/aCIgJ000000BxZR/dt466547\" rel=\"nofollow\"\u003eDT466547\u003c/a\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003eSpecial Build #81937 or later for V11.5.9 available at this link:\u003cbr\u003e\u003ca href=\"https://www.ibm.com/support/pages/node/7087189\" rel=\"noopener noreferrer nofollow\"\u003ehttps://www.ibm.com/support/pages/node/7087189\u003c/a\u003e\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003eV12.1\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003eTBD\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e\u003ca href=\"https://www.ibm.com/mysupport/s/defect/aCIgJ000000BxZR/dt466547\" rel=\"nofollow\"\u003eDT466547\u003c/a\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003eSpecial Build #83501 or later for V12.1.4 available at this link:\u003cbr\u003e\u003ca href=\"https://www.ibm.com/support/pages/node/7267513\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/pages/node/7267513\u003c/a\u003e\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eIBM does not disclose key Db2 functionality nor replication steps for a vulnerability to avoid providing too much information to any potential malicious attacker. IBM does not want to enable a malicious attacker with sufficient knowledge to craft an exploit of the vulnerability.\u003c/p\u003e"
            }
          ],
          "value": "Customers running any vulnerable affected level of an affected Program, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V11.5.9, and V12.1.4. They can be applied to any affected level of the appropriate release to remediate this vulnerability.\n\n\n\n\n\nReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 \n\n\n\nV12.1\n\n\n\n\n\n\n\nTBD\n\n\n\n\n\n\n\n https://www.ibm.com/support/pages/node/7267513 \n\n\n\n\n\n\n\n\n\nIBM does not disclose key Db2 functionality nor replication steps for a vulnerability to avoid providing too much information to any potential malicious attacker. IBM does not want to enable a malicious attacker with sufficient knowledge to craft an exploit of the vulnerability."
        }
      ],
      "title": "IBM\u00ae Db2\u00ae is vulnerable to a denial of service when executing a specially crafted query with a small statement heap",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e1) Increase statement heap by setting larger STMTHEAP.\u003c/p\u003e\u003cp\u003eor\u003c/p\u003e\u003cp\u003e2) Reduce optimization level to 0. The user can append a optimizer guideline to the query:\u003c/p\u003e\u003cp\u003e\u0026lt;query\u0026gt;\u003c/p\u003e\u003cp\u003e/* \u0026lt;OPTGUIDELINES\u0026gt;\u003c/p\u003e\u003cp\u003e\u00a0\u00a0\u0026lt;QRYOPT VALUE=\u00270\u0027/\u0026gt;\u003c/p\u003e\u003cp\u003e\u0026lt;/OPTGUIDELINES\u0026gt; */\u003c/p\u003e"
            }
          ],
          "value": "1) Increase statement heap by setting larger STMTHEAP.\n\n\n\nor\n\n\n\n2) Reduce optimization level to 0. The user can append a optimizer guideline to the query:\n\n\n\n\u003cquery\u003e\n\n\n\n/* \u003cOPTGUIDELINES\u003e\n\n\n\n\u00a0\u00a0\u003cQRYOPT VALUE=\u00270\u0027/\u003e\n\n\n\n\u003c/OPTGUIDELINES\u003e */"
        }
      ],
      "x_generator": {
        "engine": "ibm-cvegen"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2026-6051",
    "datePublished": "2026-05-27T13:07:47.761Z",
    "dateReserved": "2026-04-09T21:45:54.618Z",
    "dateUpdated": "2026-05-27T14:41:58.407Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2026-23403

CVE-2026-6051 (GCVE-0-2026-6051)

Tags

Sightings

Nomenclature