low · CVSS v3 3.3

CVE-2026-108838

IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain a vulnerability that allows a local attacker to trigger uncontrolled resource consum

Overview

IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain a vulnerability that allows a local attacker to trigger uncontrolled resource consumption. This flaw can lead to a denial of service condition on the affected system.

Description

IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a local attacker to cause a denial of service due to uncontrolled resource consumption.

Impact

The primary impact is availability, as the system may become unresponsive due to resource exhaustion. Confidentiality and integrity are not directly compromised by this specific flaw. Local users with access to the system are the primary threat actors. Organizations relying on Db2 Genius Hub for database management may experience operational disruptions if the service is taken offline.

Remediation

Apply the latest security patch or update to a version of IBM Db2 Genius Hub that addresses this vulnerability. Implement local access controls to restrict user privileges where possible. Monitor system resource usage for anomalies that may indicate resource exhaustion attempts.

Risk context

The CVSS v3 score of 3.3 indicates a low severity risk. The requirement for local access further limits the attack surface. No EPSS score is available, but the low severity and local nature suggest a lower urgency compared to remote, high-severity vulnerabilities.

Affected products

  • IBM Db2 Genius Hub 1.1.2
  • IBM Db2 Genius Hub 1.1.3
  • IBM Db2 Genius Hub 1.1.4
  • IBM Db2 Genius Hub 1.1.5

Scores

Severity
low
CVSS v2
1.7
CVSS v3
3.3
CVSS v4
—
EPSS
—

denial-of-service local-attack resource-consumption IBM Db2 low-severity

← All CVEs

Related CVEs

low

CVE-2026-122301

Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 returns field values in object create responses to callers that lack read access to the created object through class-level permissions or the object's ACL. An attacker with create permission can create objects to obtain values set by Cloud Code triggers, schema defaults, and the class default ACL.

View analysis

low

CVE-2026-107776

The Dokan WordPress plugin before 5.3.3 does not reconcile the amount credited to a vendor's reverse-withdrawal ledger against the amount actually collected for the payment order, allowing a vendor to clear their outstanding commission debt while paying less than the balance owed when a discount coupon is applied at checkout.

View analysis

low

CVE-2026-116376

IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain an open redirect flaw that can be exploited by a remote authenticated user to facilitate phishing attacks. The vulnerability allows attackers to redirect users to malicious sites after authentication, potentially compromising credentials or delivering malware. It is considered low severity but still relevant for environments that rely on this product.

View analysis

low

CVE-2026-121745

Node Version Manager (nvm) versions 0.40.0 through 0.40.8 expose authentication credentials in process arguments when downloading from private mirrors. This allows other local users on the same system to read the token via standard process inspection tools. The issue is resolved in version 0.41.0 by passing headers via stdin or private config files.

View analysis