IBM DB2 9.5 through FP10 9.7 through FP10 9.8 through FP5 10.1 through FP4 and 10.5 before FP5 allows remote authenticated users to cause a denial of service (CPU consumption) via a crafted XML query.