CVE-2026-1577 — Denial of Service

title: CVE-2026-1577 - Db2 Authenticated DoS via Malformed Data Query
id: scw-2026-04-30-ai-1
status: experimental
level: high
description: |
  Detects a specific pattern of SQL injection targeting IBM Db2 versions 11.5.0-11.5.9 and 12.1.0-12.1.4. This pattern is indicative of an authenticated user attempting to exploit CVE-2026-1577 by injecting special characters into a data query to cause a denial of service. The 'OR 1=1' clause is a common technique to manipulate query logic, and the specific table/column references (syscat.tables, tabname) are typical for Db2 administration queries.
author: SCW Feed Engine (AI-generated)
date: 2026-04-30
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-1577/
tags:
  - attack.impact
  - attack.t1499
logsource:
    category: webserver
detection:
  selection:
      cs-uri-query|contains:
          - "SELECT * FROM syscat.tables WHERE tabname LIKE '%\'' OR 1=1 --%"
          - "SELECT * FROM syscat.tables WHERE tabname LIKE '%" OR 1=1 --%"
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse