Description

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to cause a denial of service due to uncontrolled recursion.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-14T20:16:50.550Z",
  "pubdate": "2026-08-14T20:16:50.550Z",
  "executiveSummary": "IBM Db2 Mirror for i contains a vulnerability involving uncontrolled recursion that can be exploited by a remote attacker to induce a denial of service condition.\nThe vulnerability directly impacts availability by causing application or system crashes and resource exhaustion.\nAffected products include IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6.\nThe primary risk implication is the disruption of continuous availability and database replication services provided by Db2 Mirror.\nAn unauthenticated or remote attacker is capable of triggering the vulnerability over the network without requiring advanced privileges, provided network connectivity to the vulnerable service exists.\nSuccessful exploitation requires the attacker to send maliciously crafted network input or requests that provoke deep or infinite recursive function calls within the vulnerable component, exhausting execution stack resources.",
  "technicalDetails": "The vulnerability stems from a flaw of uncontrolled recursion within IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6.\nThe root cause lies in the improper handling and validation of nested or recursive input data structures within the network communication or request processing routines of the Db2 Mirror subsystem.\nWhen an attacker transmits a specifically crafted sequence of inputs over the network, the vulnerable application component initiates recursive function calls without enforcing appropriate depth limits or termination conditions.\nAs the recursion progresses unchecked, it rapidly consumes the available thread stack memory, leading directly to a stack overflow exception.\nThis stack exhaustion results in the abrupt termination of the affected process or service, causing a localized or cascading denial of service for the database replication environment.\nThe attack vector is network-based, allowing remote adversaries to interact directly with the exposed listening services associated with Db2 Mirror.\nThe exploitation does not inherently require prior authentication or elevated privileges, lowering the barrier to entry for malicious actors positioned on the network.\nPayload behavior centers on resource depletion, specifically targeting CPU and memory stack allocations associated with the recursive routines.\nPost-exploitation impact is limited to availability disruption, as the uncontrolled recursion typically causes immediate process crashes rather than remote code execution or unauthorized data disclosure."
}