EUVD-2026-104473
GHSA-4q86-f785-82j9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain MITM on unencrypted MQ channel or queue manager control
-
ExploitInject oversized queue-name length value
-
ImpactCrash async-consuming client application
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires one of two specific positions: (1) administrative control of the IBM MQ queue manager, or (2) a man-in-the-middle position on UNENCRYPTED (non-TLS) MQ channels allowing injection/modification of message metadata. The flaw is further scoped to client applications that use asynchronous message consumption (callback/message-listener style consume APIs); synchronous-only clients are not the target. Key limiting factors that reduce real-world risk: TLS/mutual-TLS on channels eliminates the MITM path; the queue-manager-control path presupposes an already-privileged attacker; impact is limited to denial of service of the affected client (A:H, no C/I impact); and the high attack complexity (AC:H) reflects the non-trivial positioning needed. |
| Impact | This is a moderate-severity, availability-only issue (CVSS 5.9, A:H with C:N/I:N) whose real-world risk is tempered by high attack complexity (AC:H) and meaningful preconditions. Although the CVSS vector lists PR:N (no privileges), the description makes clear that exploitation requires EITHER administrative control of the queue manager (a privileged position) OR a man-in-the-middle foothold on UNENCRYPTED MQ channels - so the nominal 'unauthenticated' rating overstates accessibility: an attacker still needs a privileged or network-interception position, which is consistent with the AC:H rating. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so there is no signal of active or probable near-term exploitation. The impact is confined to a denial of service in client applications using asynchronous message consumption, not the broker itself, and there is no confidentiality or integrity exposure. Net: a legitimate patch-management item (especially where plaintext channels exist), but not an emergency - it is a genuine but conditional DoS, not a high-CVSS-but-illusory issue nor a widespread-exploitation threat. Conflicting signal to note: CVSS says PR:N/AV:N but the description implies a privileged (queue-manager control) or MITM precondition - verify the exposure model against IBM's advisory and your channel encryption posture. |
| Exploit ScenarioDerived | An attacker positioned to intercept traffic on an unencrypted (non-TLS) IBM MQ channel, or one who already controls the queue manager, sends a message carrying a malformed/oversized queue name length value. A victim client application performing asynchronous message consumption fails to validate the length, triggering a buffer-related fault that crashes or hangs the client. No public exploit code was identified at time of analysis, and the high attack complexity (AC:H) plus the need for a privileged or interception position makes opportunistic exploitation unlikely. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Denial of service in IBM MQ client applications that consume messages asynchronously can be triggered when a queue name carrying an improperly validated length value reaches the client, producing a buffer overflow (CWE-120) that crashes or hangs the consuming application. The flaw affects IBM MQ Operator and IBM MQ Advanced Container Images deployments and is reachable either by an attacker who already controls the queue manager or by a man-in-the-middle able to tamper with message metadata on unencrypted, non-TLS channels. IBM has released a vendor patch per its support advisory, no public exploit code or active exploitation has been identified at time of analysis, and the CVSS 5.9 score reflects availability-only impact with high attack complexity.
RemediationAI
Apply the vendor-released fix documented in IBM's support advisory at https://www.ibm.com/support/pages/node/7292667, upgrading IBM MQ Operator and IBM MQ Advanced Container Images to the corrected build levels listed there, and roll the updated client libraries into any application that performs asynchronous message consumption; exact fix version numbers were not included in the supplied data and must be read from the advisory rather than assumed. Because patch data confirms availability without naming a version, treat "Vendor-released patch" as advisory-confirmed and verify the build before closing the finding. As compensating controls, enforce TLS or mutual TLS on every MQ channel in the estate, which eliminates the man-in-the-middle injection path at the cost of certificate lifecycle management and a modest throughput overhead; restrict queue manager administrative authority to a minimal, audited set of accounts, since the alternate trigger presupposes an already-privileged operator; and, where TLS rollout is not immediate, prefer synchronous GET consumption or add client-side validation of queue-name length before it is passed into listener code, accepting that this requires application code changes and does not fix the underlying memory-safety flaw. Network-level segmentation of channel ports to trusted peers is a useful defence-in-depth layer but does not remove the privileged-insider path.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM MQ is a message-oriented middleware stack in which a queue manager brokers messages between producers and consumers over channels. CWE-120 (classic buffer overflow) here stems from the queue manager or channel path failing to validate the length field associated with a queue name before it is handed to client-side message-processing code; a length that exceeds the destination buffer corrupts memory in the client process. The defect is specifically exercised through asynchronous consumption APIs (message-listener/callback style consumers) rather than synchronous GET loops, which narrows the set of exploitable client applications. CPE data identifies the packaged delivery vehicles as IBM MQ Operator and IBM MQ Advanced Container Images, with wildcarded versions in the feed, so exact build ranges must be taken from the IBM advisory. The CVSS vector scores the issue as network-reachable and unauthenticated (AV:N/PR:N) because the victim client supplies no credentials to trigger the parsing path, but the assessed prerequisites are narrower: the attacker must either hold administrative control of the queue manager (an already-privileged position) or occupy a man-in-the-middle position on a plaintext MQ channel so that message metadata can be injected or modified. Enforcing TLS or mutual TLS on channels removes the MITM route entirely, and the AC:H rating captures the non-trivial positioning required for either path; impact is confined to availability (A:H with C:N/I:N).
Know when Mq Operator gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable but needs MITM-on-plaintext or queue-manager control, so AC:H; modeled as PR:N for the unauthenticated MITM path; availability-only DoS gives C:N/I:N/A:H.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM MQ could allow a remote attacker with queue manager control or man-in-the-middle access on unencrypted channels to cause a denial of service in client applications using asynchronous message consumption due to improper validation of queue name length values.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Mq Operator
View allIBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 could allow a user to bypass authentication under certain configuration
Heap buffer overflow in IBM MQ Operator and IBM MQ Advanced Container Images lets an authenticated user with authority t
Denial of service and potential remote code execution in IBM MQ deployments using the MQ Operator and MQ Advanced Contai
Authenticated users of containerized IBM MQ deployments can cause denial of service or memory corruption by sending MQOP
IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow an authenticated user in a specifically define
Unauthenticated remote code execution is possible against IBM MQ deployments exposed through the MQ Operator and MQ Adva
Authenticated attackers with access to IBM MQ Operator or MQ Advanced Container Images deployments can exploit unrestric
IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 IBM MQ Container Developer Edition is vulnerable to denial of service c
IBM MQ Operator 2.0.0 LTS, 2.0.18 LTS, 3.0.0 CD, 3.0.1 CD, 2.4.0 through 2.4.7, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2
IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0,
Denial of service in IBM MQ Operator and IBM MQ Advanced container images lets an authenticated MQ client crash the queu
Authenticated denial of service in IBM MQ container deployments - specifically the MQ Operator and MQ Advanced container
Exploit-DB