CVE-2023-45193 is a medium severity denial of service flaw in the federated server of IBM Db2 11.5, scored 5.9. IBM offers special builds for V11.5.8 and V11.5.9 and says V11.5.0 is not vulnerable. IBM lists no workaround, so plan the update and check which instances use federation.
What's affected
IBM bulletin node 7105501, first published on 8 January 2024, says Db2 for Linux, UNIX and Windows (including Db2 Connect Server) 11.5 with a federated server is affected. It lists all platforms as affected. The NVD record was published on 2024-01-22.
IBM and NVD both give 5.9, Medium. The IBM bulletin uses the vector CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H and NVD uses the CVSS 3.1 equivalent CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. The sources agree.
The fix is a special build. The bulletin says Db2 V11.5.0 is not vulnerable, and lists special builds for V11.5.8 and V11.5.9 on AIX, Linux (x86, POWER little endian and System z) and Windows. The fix pack entry reads TBD, so check whether a later fix pack now includes the fix. The bulletin lists no workarounds.
IBM says it does not disclose key Db2 functionality or replication steps for vulnerabilities, so details about the crafted cursor are not public.
Weakness class: CWE-20 (improper input validation).
How to check if you're exposed
Connect to the instance as an administrator and run:
db2level
This prints the product version and fix pack. Then check whether the federated feature is enabled:
db2 get dbm cfg | grep -i federated
If federated support is off, the affected component is not in use. Compare the version with the bulletin: 11.5.0 is not vulnerable, while 11.5.8 and 11.5.9 need the special build or a later fix pack.
What to do now
- List all Db2 11.5 instances and record the exact fix pack.
- Find which instances have the federated server enabled.
- Download the special build for V11.5.8 or V11.5.9 from the IBM bulletin, or move to a fix pack that includes the fix.
- Test the update in a non production instance first, as with any database engine update.
- Limit which clients can reach federated instances while you schedule the work, because IBM lists no workaround.
Why it matters
The record maps the flaw to improper input validation, tracked as CWE-20. A specially crafted cursor makes the federated server fail, which affects availability. Confidentiality and integrity are not touched according to the vector.
A database outage can stop every application that depends on it, so a medium score can still carry a high business cost. The high attack complexity in the score reflects conditions the attacker must meet first. CVE-2023-45193 is not on the CISA Known Exploited Vulnerabilities list, and none of the pages I read says it has been exploited in the wild. That is a statement about what is recorded, not a reason to delay.
The NetApp advisory linked from the record, which covers products that embed Db2 components, did not load when I fetched it. If you run NetApp software, check that advisory directly.
Quick check
Which Db2 versions are affected by CVE-2023-45193?
Db2 11.5 with a federated server. IBM says V11.5.0 is not vulnerable and provides special builds for V11.5.8 and V11.5.9.
Is there a workaround?
No. The IBM bulletin lists none.
Sources
- Gold entry for CVE-2023-45193
- IBM security bulletin
- IBM X-Force entry 268759 (page did not render when fetched)
Last reviewed: 19 October 2026.
