Description
IBM MQ 9.4.0.0 to 9.4.0.26, 9.4.1.0 to 9.4.5.3, and 10.0.0.1 to 10.0.0.5 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header structure length fields.
Published: 2026-11-04
Score: 5.4 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Solution

This vulnerability is addressed under APAR DT500605. IBM strongly recommends addressing the vulnerability now. IBM MQ Appliance version 9.4 LTS Apply IBM MQ Appliance fix pack 9.4.0.30 https://www.ibm.com/support/fixcentral/swg/selectFixes , or later firmware. IBM MQ Appliance version 9.4 CD - M2003 Upgrade to IBM MQ Appliance 10.0.0.6 https://www.ibm.com/support/fixcentral/swg/selectFixes , or later firmware. IBM MQ Appliance version 9.4 CD - M2002 Apply IBM MQ Appliance cumulative security update 9.4.5.4 https://www.ibm.com/support/fixcentral/swg/selectFixes , or later firmware. IBM MQ Appliance version 10 LTS Apply IBM MQ Appliance cumulative security update 10.0.0.6 https://www.ibm.com/support/fixcentral/swg/selectFixes , or later firmware.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 04 Nov 2026 20:45:00 +0000

Type Values Removed Values Added
Description IBM MQ 9.4.0.0 to 9.4.0.26, 9.4.1.0 to 9.4.5.3, and 10.0.0.1 to 10.0.0.5 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header structure length fields.
Title IBM MQ Appliance is affected by an improper validation vulnerability
First Time appeared Ibm
Ibm mq Appliance
Weaknesses CWE-124
CPEs cpe:2.3:a:ibm:mq_appliance:9.4.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:mq_appliance:9.4.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:mq_appliance:9.4.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:mq_appliance:9.4:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm mq Appliance
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L'}

Subscriptions

Ibm Mq Appliance
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-11-04T20:25:41.490Z

Reserved: 2026-06-17T15:22:07.491Z

Link: CVE-2026-12538

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-04T21:18:11.440

Modified: 2026-11-04T21:18:11.563

Link: CVE-2026-12538

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-04T22:00:18Z

Weaknesses
  • CWE-124

    Buffer Underwrite ('Buffer Underflow')