CVE-2026-11906: IBM® Db2® federated server is vulnerable to a denial of service due to improper neutralization of special elements in the data query logic of XMLTable-derived columns by autheticated user
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in the data query logic of XMLTable-derived columns.
Other sources
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in the data query logic of XMLTable-derived columns.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server)to a version that resolves this vulnerability.Fixed in 11.5.9 - Upgrade
Upgrade
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server)to a version that resolves this vulnerability.Fixed in 12.1.4 - Compensating control
For any federated server instances, mitigate the denial-of-service exposure by restricting/controlling access to the federated server so only trusted authenticated users can reach XMLTable-derived query logic (since IBM® Db2® federated server is vulnerable to denial of service via improper neutralization of special elements in XMLTable-derived columns).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11906?
CVE-2026-11906 has a medium severity rating of 6.5.
What does CVE-2026-11906 affect?
CVE-2026-11906 affects IBM Db2 versions 11.5.0 to 11.5.9 and 12.1.0 to 12.1.4.
How can CVE-2026-11906 be exploited?
CVE-2026-11906 can be exploited by an authenticated user to cause a denial of service through malicious data queries.
How do I fix CVE-2026-11906?
To fix CVE-2026-11906, users should apply the latest patches or updates provided by IBM for affected Db2 versions.
Is CVE-2026-11906 a critical vulnerability?
CVE-2026-11906 is not classified as a critical vulnerability, but it poses a risk of denial of service.