IBM Db2 versions 11.5.0 to 11.5.9 and 12.1.0 to 12.1.4 for Linux, UNIX, and Windows contain a vulnerability identified as CWE-1284, involving improper validation of specified quantity in input. This flaw allows an authenticated user to cause a denial of service condition by leveraging improper neutralization of special elements within data query logic. The vulnerability has a CVSS 3.1 base score of 6.5, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction. The vulnerability affects availability only, with no impact on confidentiality or integrity. No vendor advisory or patch information is currently available.

An authenticated user can exploit this vulnerability to cause a denial of service in affected IBM Db2 database instances, impacting the availability of the service. There is no impact on data confidentiality or integrity. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user privileges to minimize potential exploitation. Monitor IBM security advisories for updates regarding patches or mitigations.