CVE-2026-10695

This CVE affects IBM Db2 versions 12.1.0 through 12.1.4 and targets the federated query execution path when operating in non-fenced mode. The distinction matters: fenced mode runs federated queries in a process-isolated from the database engine, sacrificing some performance for safety; non-fenced mode runs in the same address space as the database, making queries faster but allowing a malformed federated query to crash the entire Db2 instance. That crash is the DoS vector. If you run federated queries in your environment, the immediate action is to determine whether they are executing in fenced or non-fenced mode. IBM provides server options for this—check FEDERATED and FENCED/PASSTHRU settings on your nickname and wrapper configurations. If non-fenced is active, you are exposed to this DoS. Switching to fenced mode is the mitigation pending the vendor patch. The blast radius extends beyond Db2. A federated server holds active connections to external data sources (Oracle, SQL Server, PostgreSQL). When it crashes mid-query, it often leaves orphaned transactions on those upstream systems—connections severed abruptly rather than cleanly rolled back. This can leave distributed locks held and incomplete operations scattered across database products that don't know they were part of a federated context. Your Oracle or SQL Server DBA may see unexplained locks or failed transactions without knowing Db2 triggered them. The CVSS 5.5 should not drive deprioritization. The cross-database cascade and orphaned transaction risk make this more operationally severe than the score implies. IBM has patched federated path vulnerabilities in previous release cycles—this appears to be a recurring attack surface in the federated middleware layer, not a one-off. Treat it as such.

Reviewed through automated stages and approved by a human before publication.