EUVD-2026-104462
GHSA-mmjj-225r-72h6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to IBM MQ queue manager
-
DeliveryCraft message triggering charset conversion
-
ExploitSend to target queue
-
ExecutionExhaust memory during conversion
-
ImpactDenial of service on queue manager
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Exploitation requires the attacker to hold valid authenticated access to an IBM MQ queue manager (PR:L) and to send a message that specifically triggers the character-set (CCSID) conversion code path - so deployments performing data/character-set conversion on messages are the exposed surface. The limiting factors are significant: valid credentials are mandatory (no unauthenticated path), attack complexity is high (AC:H) because the message must be crafted to reliably force the excessive memory operations during conversion, and the affected footprint per the CPEs is specifically the IBM MQ Operator and MQ Advanced container images rather than all MQ installations. Impact is confined to availability (service disruption) with no data exposure or modification. |
| Impact | This is a moderate-severity, low-priority issue rather than an urgent threat. The CVSS 3.1 base score of 5.3 (vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects a network-reachable but availability-only impact that requires both authentication (PR:L) and high attack complexity (AC:H), meaning the attacker must already hold valid credentials to the queue manager and must craft a message that reliably triggers a specific character-set-conversion edge case. No EPSS probability, CISA KEV listing, POC, or SSVC decision data was provided in the input, and there is no public exploit identified at time of analysis - all consistent signals pointing to low real-world exploitation likelihood. The only elevated signal is the pure availability impact (A:H), but that is bounded by the authentication requirement and the absence of any confidentiality or integrity impact (C:N/I:N). Net: a legitimately exploitable DoS against authenticated clients, worth patching in normal cycles but not an emergency; no conflicting signals were detected in the supplied data. |
| Exploit ScenarioDerived | An attacker who already possesses valid credentials to an IBM MQ queue manager (for example a compromised or malicious application identity) connects and sends a specially crafted message whose payload forces excessive memory operations during character set conversion, exhausting resources and degrading or halting message processing. Because AC:H applies, the message must meet specific conditions to reliably trigger the fault, and no public proof-of-concept exists at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
IBM MQ Operator and MQ Advanced container images can be driven into a denial-of-service condition by an authenticated queue-manager user who submits a specially crafted message that forces excessive memory operations during character-set (CCSID) conversion; the CVSS 3.1 score is 5.3 with an all-availability impact, high attack complexity, and low privileges required. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS data was not provided, so this is a moderate-severity, low-priority issue rather than an urgent threat. Impact is confined to service disruption - there is no confidentiality or integrity exposure from the conversion fault itself.
RemediationAI
IBM states a vendor patch is available; consult the IBM support bulletin at https://www.ibm.com/support/pages/node/7292667 for the exact fixed IBM MQ Operator and MQ Advanced container image builds and upgrade to those versions - the referenced advisory is the authoritative source for version numbers, so do not assume a fix level without checking it. Where an immediate upgrade is not possible, reduce exposure by ensuring only trusted, validated principals hold queue-manager access, since PR:L (valid credentials) is mandatory for exploitation; restrict which inbound channels and topics accept externally sourced messages; and avoid unnecessary CCSID conversion by standardizing producer and consumer character sets (e.g. UTF-8 end to end) so messages skip the vulnerable translation path - the trade-off is migration effort and possible incompatibility with legacy clients that emit non-UTF-8 payloads. Additionally, cap memory and set pod/container resource limits for MQ Operator-managed queue managers so an oversized conversion is contained to a restart rather than node-level memory pressure, accepting that the queue manager may still be temporarily unavailable; monitor for repeated conversion-related allocation spikes or container OOMKills as a detection signal for attempted abuse.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-681 (Incorrect Conversion between Numeric Types), a memory/resource-consumption flaw that surfaces in IBM MQ's character-set conversion layer rather than in authentication or message routing logic. When IBM MQ receives a message whose encoded character set (CCSID) requires conversion, it allocates buffers and performs numeric size/count calculations to translate between the source and target encodings; a crafted message can skew those calculations so the conversion path repeatedly performs oversized memory operations, exhausting queue-manager memory and degrading or halting service. The affected footprint per the supplied CPEs is specifically the containerized distribution - IBM MQ Operator and IBM MQ Advanced container images - rather than every MQ deployment, meaning Kubernetes/OpenShift-managed MQ estates are the primary exposure and installs that never exercise CCSID conversion on inbound messages are effectively out of the blast radius. The network-vector, high-complexity, low-privilege vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects that only a validated queue-manager principal can reach the vulnerable code and that the payload must be tuned to reliably trigger the excessive allocation.
Know when Mq Operator gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable messaging (AV:N) but requires authenticated client (PR:L) and a specifically crafted conversion-triggering message (AC:H); impact is availability-only (A:H), no C/I.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM MQ could allow an authenticated attacker to cause a denial of service through a specially crafted message that triggers excessive memory operations during character set conversion.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Mq Operator
View allIBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 could allow a user to bypass authentication under certain configuration
Heap buffer overflow in IBM MQ Operator and IBM MQ Advanced Container Images lets an authenticated user with authority t
Denial of service and potential remote code execution in IBM MQ deployments using the MQ Operator and MQ Advanced Contai
Authenticated users of containerized IBM MQ deployments can cause denial of service or memory corruption by sending MQOP
IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow an authenticated user in a specifically define
Unauthenticated remote code execution is possible against IBM MQ deployments exposed through the MQ Operator and MQ Adva
Authenticated attackers with access to IBM MQ Operator or MQ Advanced Container Images deployments can exploit unrestric
IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 IBM MQ Container Developer Edition is vulnerable to denial of service c
IBM MQ Operator 2.0.0 LTS, 2.0.18 LTS, 3.0.0 CD, 3.0.1 CD, 2.4.0 through 2.4.7, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2
IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0,
Denial of service in IBM MQ Operator and IBM MQ Advanced container images lets an authenticated MQ client crash the queu
Authenticated denial of service in IBM MQ container deployments - specifically the MQ Operator and MQ Advanced container
Exploit-DB