CVE-2026-11376 PUBLISHED

IBM MQ is affected by a denial of service vulnerability

Assigner: ibm
Reserved: 05.06.2026 Published: 04.11.2026 Updated: 04.11.2026

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow when processing subscription requests with crafted buffer size values.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 8.8

Product Status

Vendor IBM
Product MQ
Versions
  • affected from 9.2.0.0 to 9.2.0.44 (incl.)
  • affected from 9.3.0.0 to 9.3.0.42 (incl.)
  • affected from 9.4.0.0 to 9.4.0.26 (incl.)
  • affected from 9.4.0.0 to 9.4.5.1 (incl.)
  • affected from 10.0.0.0 to 10.0.0.5 (incl.)

Solutions

This issue was addressed under Known Issue DT473422.

IBM MQ version 9.2 LTS

Apply cumulative security update 9.2.0.46 https://www.ibm.com/support/pages/downloading-ibm-mq-92-lts

IBM MQ version 9.3 LTS

Apply cumulative security update 9.3.0.43 https://www.ibm.com/support/pages/downloading-ibm-mq-93-lts

IBM MQ version 9.4 LTS

Apply fix pack 9.4.0.30 https://www.ibm.com/support/pages/downloading-ibm-mq-94

IBM MQ version 10.0.LTS

Upgrade to IBM MQ version 10.0.0.6 https://www.ibm.com/support/pages/downloading-ibm-mq-100

IBM MQ version 9.4 CD and 10.0 CD

Upgrade to IBM MQ version 10.0.1.0 https://www.ibm.com/support/pages/downloading-ibm-mq-100

References

Problem Types

  • CWE-190 Integer Overflow or Wraparound CWE