CVE-2026-11828: IBM MQ Buffer Overflow
IBM MQ could allow a remote attacker with queue manager control or man-in-the-middle access on unencrypted channels to cause a denial of service in client applications using asynchronous message consumption due to improper validation of queue name length values.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM MQ Containerto a version that resolves this vulnerability.Fixed in 10.0.0.5-r2 - Upgrade
Upgrade
IBM MQ Containerto a version that resolves this vulnerability.Fixed in 10.0.1.0-r1 - Upgrade
Upgrade
IBM MQ Advanced container imageto a version that resolves this vulnerability.Fixed in 9.4.0.26-r2 - Upgrade
Upgrade
IBM MQ Operatorto a version that resolves this vulnerability.Fixed in v3.2.30 - Upgrade
Upgrade
IBM MQ Operatorto a version that resolves this vulnerability.Fixed in v4.0.5 - Upgrade
Upgrade
IBM MQ Operatorto a version that resolves this vulnerability.Fixed in v4.1.0
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Client applications that use asynchronous message consumption are affected when they communicate with an attacker-controlled queue manager or over an unencrypted channel where an attacker can act as a man in the middle. IBM MQ, IBM MQ Operator, and IBM-supplied MQ Advanced container images are listed as affected software.
What access does an attacker need to exploit it?
The attacker must have control of a queue manager or be able to intercept and modify traffic on an unencrypted channel. No prior privileges or user interaction are required, but exploitation has high attack complexity.
What is the impact of successful exploitation?
Successful exploitation can cause a denial of service in affected client applications. The provided severity vector indicates no confidentiality or integrity impact.