{"id":"CVE-2024-39724","aliases":["EUVD-2024-55395","GHSA-hfg5-h6jx-rgvq"],"status":"published","title":"IBM Db2 Big SQL on Cloud Pak for Data is vulnerable to a denial of service due to lack of throttling on an API","description":"IBM Db2 Big SQL on Cloud Pak for Data versions 7.6 (on CP4D 4.8), 7.7 (on CP4D 5.0), and 7.8 (on CP4D 5.1) do not properly limit the allocation of system resources. An authenticated user with internal knowledge of the environment could exploit this weakness to cause a denial of service.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00325,"percentile":0.25888,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-770"],"published":"2026-02-04T20:52:21Z","modified":"2026-06-17T07:42:32Z","products":[{"vendor":"ibm","product":"db2 big sql on cloud pak for data"}],"references":[{"url":"https://www.ibm.com/support/pages/node/7257907","tags":["vendor-advisory","patch"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39724"},{"url":"https://github.com/advisories/GHSA-hfg5-h6jx-rgvq"}],"sources":{"cve":[{"id":"CVE-2024-39724","title":"IBM Db2 Big SQL on Cloud Pak for Data is vulnerable to a denial of service due to lack of throttling on an API","description":"IBM Db2 Big SQL on Cloud Pak for Data versions 7.6 (on CP4D 4.8), 7.7 (on CP4D 5.0), and 7.8 (on CP4D 5.1) do not properly limit the allocation of system resources. An authenticated user with internal knowledge of the environment could exploit this weakness to cause a denial of service.","status":"published","published":"2026-02-04T20:52:21.777Z","modified":"2026-02-04T21:30:20.09Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:34:18.951288Z"}],"euvd":[{"id":"EUVD-2024-55395","description":"IBM Db2 Big SQL on Cloud Pak for Data versions 7.6 (on CP4D 4.8), 7.7 (on CP4D 5.0), and 7.8 (on CP4D 5.1) do not properly limit the allocation of system resources. An authenticated user with internal knowledge of the environment could exploit this weakness to cause a denial of service.","status":"published","published":"2026-02-04T20:52:21Z","modified":"2026-02-04T21:30:20Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T19:48:43.720683Z"}],"ghsa":[{"id":"GHSA-hfg5-h6jx-rgvq","title":"IBM Db2 Big SQL 7.6 on Cloud Pak for Data 4.8, 7.7 on Cloud Pak for Data 5.0, and 7.8 on Cloud...","description":"IBM Db2 Big SQL 7.6 on Cloud Pak for Data 4.8, 7.7 on Cloud Pak for Data 5.0, and 7.8 on Cloud Pak for Data 5.1 does not properly limit allocation of resources which could allow an authenticated user with internal knowledge of the system to cause a denial of service.","status":"published","published":"2026-02-04T21:30:32Z","modified":"2026-02-04T21:30:43Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:06:03.410025Z"}],"nvd":[{"id":"CVE-2024-39724","description":"IBM Db2 Big SQL on Cloud Pak for Data versions 7.6 (on CP4D 4.8), 7.7 (on CP4D 5.0), and 7.8 (on CP4D 5.1) do not properly limit the allocation of system resources. An authenticated user with internal knowledge of the environment could exploit this weakness to cause a denial of service.","status":"published","published":"2026-02-04T21:15:56.817Z","modified":"2026-06-17T07:42:32.893Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:10:47.444899Z"}]}}