CVE-2026-6051: IBM Db2 Denial of Service Vulnerability

CVE-2026-6051 Overview

CVE-2026-6051 is a denial of service vulnerability affecting IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4. An authenticated local user can submit a specially crafted query against a database configured with a small statement heap, exhausting available memory resources and causing the database engine to become unresponsive. The flaw is classified under [CWE-400] (Uncontrolled Resource Consumption) and requires only low privileges to exploit. No public proof-of-concept code or evidence of exploitation in the wild has been reported.

Critical Impact

Successful exploitation results in a complete loss of database availability, disrupting any application or service that depends on the affected Db2 instance.

Affected Products

• IBM Db2 11.5.0 through 11.5.9
• IBM Db2 12.1.0 through 12.1.4
• Db2 deployments configured with a small statement heap (STMTHEAP)

Discovery Timeline

• 2026-05-27 - CVE-2026-6051 published to the National Vulnerability Database
• 2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-6051

Vulnerability Analysis

The vulnerability resides in the query processing path of IBM Db2. When the database manager parses and optimizes a specially crafted SQL statement, the work area required to compile the statement can exceed the configured statement heap size. Instead of failing gracefully, the condition leads to resource exhaustion that disrupts service availability.

The defect maps to [CWE-400], Uncontrolled Resource Consumption. The attack surface is restricted to actors that already possess valid database credentials, since the issue requires the ability to submit SQL to the engine. Confidentiality and integrity of stored data are not affected, but availability of the database service is compromised for the duration of the condition.

Root Cause

The root cause is improper handling of memory allocation during compilation of a crafted query under constrained statement heap conditions. The STMTHEAP parameter controls the work area used by the SQL compiler for each statement. A crafted statement consumes more space than the heap permits, and the engine fails to recover cleanly, leading to a denial of service.

Attack Vector

Exploitation requires local access with low privileges and a valid Db2 session. The attacker connects to the database and issues the crafted query against an instance where STMTHEAP has been set to a small value. No user interaction is required. Refer to the IBM Support advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-6051

Indicators of Compromise

• Db2 diagnostic log (db2diag.log) entries reporting SQL0954C statement heap exhaustion or out-of-memory conditions during query compilation
• Sudden termination or hang of the Db2 engine process correlated with a single client session
• Repeated failed query compilations originating from the same authenticated user

Detection Strategies

• Monitor Db2 diagnostic logs for statement heap allocation failures and abnormal compiler errors
• Correlate authenticated session activity with engine restarts or availability incidents
• Establish baselines for query compilation memory usage and alert on outliers from a single principal

Monitoring Recommendations

• Forward db2diag.log and operating system process events to a centralized analytics platform for retention and correlation
• Track Db2 memory usage metrics, particularly statement heap consumption, through native monitoring views such as MON_GET_MEMORY_POOL
• Alert on repeated SQL0954C errors tied to the same user, host, or application name

How to Mitigate CVE-2026-6051

Immediate Actions Required

• Apply the fixes referenced in the IBM Support advisory for IBM Db2 11.5 and 12.1
• Review and restrict database privileges so that only trusted accounts can submit ad hoc SQL
• Audit the configured STMTHEAP value and increase it where workloads justify a larger compiler work area

Patch Information

IBM has published remediation guidance and fix pack information in the vendor advisory at IBM Support node 7273558. Customers running IBM Db2 11.5.0 through 11.5.9 or 12.1.0 through 12.1.4 should upgrade to a fixed level identified in the advisory.

Workarounds

• Increase the STMTHEAP database configuration parameter to reduce the likelihood of exhausting the statement work area
• Limit CONNECT and SQL execution privileges to vetted application service accounts
• Enforce query timeouts and workload management thresholds using Db2 Workload Manager to terminate abusive statements

# Configuration example: review and raise the statement heap
db2 connect to <DBNAME>
db2 get db cfg for <DBNAME> | grep -i STMTHEAP
db2 update db cfg for <DBNAME> using STMTHEAP 16384 IMMEDIATE