IBM MQ CVE-2025-36128

Exploitation requires network reachability to an IBM MQ queue manager TCP listener (default channel port, commonly 1414) on an affected version (9.1/9.2/9.3/9.4 LTS or 9.3/9.4 CD). The root cause is improper enforcement of the timeout on individual read operations, so the attacker exploits slow/incomplete reads (slowloris-type) to hold connections open. No authentication, credentials, or user interaction are needed (PR:N/UI:N). The practical limiting factor is exposure: impact is confined to availability, and risk is bounded by whether the listener is reachable from untrusted networks versus isolated behind firewalls/VPN or protected by connection rate-limiting and timeout controls; internal-only queue managers face substantially lower real-world exposure.

This is a moderate-priority availability issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) confirms a network-reachable, low-complexity, unauthenticated, no-interaction attack with impact limited solely to availability (C:N/I:N) - consistent with the slowloris-style resource-exhaustion denial of service described. The signals are internally consistent: a slowloris attack does fit AV:N/AC:L/PR:N. However, the quantitative exploitation signals temper the raw score: EPSS is only 0.54% (44th percentile), the CVE is NOT on the CISA KEV list, and no public exploit code is referenced, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The 7.5 is driven entirely by ease of reach and high availability impact, not by confidentiality/integrity loss or observed in-the-wild activity. Net: treat as a standard patch-cycle item for internet- or partner-facing MQ listeners, escalating only where MQ availability is business-critical and the queue manager listener is exposed to untrusted networks. No key signals are contradictory; the main limitation is that slowloris techniques are generic and well understood, so weaponization is plausible even without published PoC.

A remote, unauthenticated attacker opens many TCP connections to an exposed IBM MQ queue manager listener and sends partial/slow read-triggering traffic, holding each connection open because the per-read timeout is not properly enforced. Accumulated half-open or stalled connections exhaust connection/resource limits, preventing legitimate clients from connecting and effectively taking the messaging service offline. No public exploit is referenced, but slowloris tooling is generic and readily adaptable.