Advisoriesby IbisIBMCVE-2026-12150
IBM MQ: denial of service
No fix yet
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow a remote attacker with a trusted TLS client certificate to cause a denial of service and potentially affect memory contents due to improper validation of deeply nested certificate data during TLS certificate processing.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| MQ Product | >= 9.1.0.0, <= 9.1.0.37 LTS | No fix yet |
| >= 9.2.0.0, <= 9.2.0.43 LTS | No fix yet | |
| >= 9.3.0.0, <= 9.3.0.41 LTS | No fix yet | |
| >= 9.3.0.0, <= 9.3.5.1 CD | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-121