IBM MQ is affected by a denial of service vulnerability

IBM MQ2026-11-04 20:21 UTC1 min readRead in

Summary

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow a remote authenticated attacker to cause a denial of service and perform limited memory corruption due to an integer overflow.

Remediation

Inventory every IBM MQ deployment, including staging.
No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

Patchhttps://www.ibm.com/support/pages/node/7294663

CVSS vector

Attack vector: Network
Complexity: Low
Privileges: Low
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: Low
Availability: High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Affected versions

Version	Fixed in
9.2.0.0 – 9.2.0.44	None yet
9.3.0.0 – 9.3.0.42	None yet
9.4.0.0 – 9.4.0.26	None yet
9.4.0.0 – 9.4.5.1	None yet
10.0.0.0 – 10.0.0.5	None yet

Weakness

CWE-190

Timeline

2026-11-04Publicly disclosed

Sources

CVE · NVD