IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8.0 and 5.0.0 contain a resource allocation vulnerability (CWE-770) that allows an authenticated user to cause a denial of service by creating new databases. The issue arises from the lack of limits or throttling on resource allocation during database creation, potentially exhausting system resources and impacting service availability. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, no confidentiality or integrity impact, but high impact on availability. No patch or official remediation level has been disclosed by IBM as of the publication date.

An authenticated user can cause a denial of service condition by creating new databases without resource allocation limits, potentially exhausting system resources and disrupting availability of the IBM Db2 service on Cloud Pak for Data. There is no impact on confidentiality or integrity.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until a fix is available, limit authenticated user permissions to prevent unauthorized database creation or implement administrative controls to monitor and restrict resource usage related to database creation.