CVE-2026-1352
Improper Input Neutralization in IBM Db2 Causes Denial of Service
Publication date: 2026-04-23
Last updated on: 2026-04-27
Assigner: IBM Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ibm | db2 | From 11.5.0 (inc) to 11.5.9 (inc) |
| ibm | db2 | From 11.5.0 (inc) to 11.5.9 (inc) |
| ibm | db2 | From 11.5.0 (inc) to 11.5.9 (inc) |
| ibm | db2 | From 12.1.0 (inc) to 12.1.4 (inc) |
| ibm | db2 | From 12.1.0 (inc) to 12.1.4 (inc) |
| ibm | db2 | From 12.1.0 (inc) to 12.1.4 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1284 | The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-1352 is a vulnerability in IBM Db2 for Linux, UNIX, and Windows (including Db2 Connect Server) that allows an authenticated user to cause a denial of service (DoS). This happens when a specially crafted SQL query involving a defined index is compiled, causing the system to trap or return an error code SQLCODE -901.
The root cause is improper neutralization of special elements in the data query logic, which means the system does not properly validate or handle certain inputs in SQL queries. This is classified under CWE-1284: Improper Validation of Specified Quantity in Input.
The vulnerability has a CVSS v3.1 base score of 6.5, indicating a medium severity. It is remotely exploitable with low attack complexity, requires low privileges, no user interaction, and results in a high impact on availability without affecting confidentiality or integrity.
How can this vulnerability impact me? :
This vulnerability can impact you by causing a denial of service (DoS) condition on your IBM Db2 database system. An attacker who is authenticated with low privileges can exploit this flaw by submitting a specially crafted SQL query, which can cause the database system to crash or become unresponsive.
The impact is specifically on the availability of the database service, meaning legitimate users may be unable to access or use the database while the DoS condition persists. However, this vulnerability does not affect the confidentiality or integrity of your data.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability occurs when compiling a specially crafted SQL query involving a defined index, which can cause the system to trap or return SQLCODE -901.
IBM does not disclose detailed exploitation or replication steps to prevent aiding potential attackers.
As a detection approach, monitoring for SQLCODE -901 errors in Db2 logs or system error reports may indicate attempts to exploit this vulnerability.
No specific commands for detection are provided, but reviewing Db2 error logs and monitoring for abnormal SQL query failures related to defined indexes is recommended.
What immediate steps should I take to mitigate this vulnerability?
IBM has released special interim fix builds to address this vulnerability: Special Build #79671 for version 11.5.9 and Special Build #80714 for version 12.1.4, which can be applied to any affected level within the respective release lines.
As a workaround, users can disable certain SORT operations used in JOIN optimizations by setting the registry variable:
- db2set -im DB2_REDUCED_OPTIMIZATION="NO_SORT_NLJOIN,NO_SORT_MGJOIN"
Customers are advised to assess the impact of this vulnerability in their environments and apply the provided fixes or mitigations accordingly.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability described in CVE-2026-1352 results in a denial of service (DoS) condition affecting availability but does not impact confidentiality or integrity of data.
Since the vulnerability does not affect data confidentiality or integrity, it does not directly compromise compliance with standards focused on data privacy and protection such as GDPR or HIPAA.
However, the availability impact caused by this vulnerability could affect operational continuity, which may indirectly influence compliance requirements related to system availability and reliability.
Organizations should assess the risk of denial of service in their environments and apply the provided fixes or mitigations to maintain compliance with availability-related controls in these standards.