IBM Mq Operator
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in IBM Mq Operator.
By the Year
In 2026 there have been 17 vulnerabilities in IBM Mq Operator with an average score of 6.1 out of ten. Last year, in 2025 Mq Operator had 5 security vulnerabilities published. That is, 12 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 0.05
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 17 | 6.11 |
| 2025 | 5 | 6.16 |
| 2024 | 6 | 7.43 |
It may take a day or so for new Mq Operator vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent IBM Mq Operator Security Vulnerabilities
IBM MQ Heap Overflow via MQPUT may allow DoS or code execution
CVE-2026-10572
8.8 - High
- October 19, 2026
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT operations with malformed message options.
Heap-based Buffer Overflow
IBM MQ Heap Buffer Overflow in MQPUT1 Leading to Arbitrary Code Execution
CVE-2026-10574
8.8 - High
- October 19, 2026
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT or MQPUT1 operations with malformed message handle properties.
Heap-based Buffer Overflow
IBM MQ Authenticated Attacker Can Cause DoS via MQOPEN Buffer Size Validation
CVE-2026-10743
8.8 - High
- October 19, 2026
IBM MQ could allow an authenticated attacker to cause a denial of service or corrupt memory due to improper validation of buffer sizes in MQOPEN operations.
Race Condition for Write-Once Attributes
IBM MQ: Improper Queue Name Length Validation Client DS
CVE-2026-11828
5.9 - Medium
- October 19, 2026
IBM MQ could allow a remote attacker with queue manager control or man-in-the-middle access on unencrypted channels to cause a denial of service in client applications using asynchronous message consumption due to improper validation of queue name length values.
Classic Buffer Overflow
IBM MQ DoS via Improper Offset Validation in MQOPEN
CVE-2026-11829
6.5 - Medium
- October 19, 2026
IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of offset values in MQOPEN requests.
Classic Buffer Overflow
IBM MQ: Authenticated Bof Causes DoS & Info Leak via OOB Read in Client Request
CVE-2026-11831
5.4 - Medium
- October 19, 2026
IBM MQ could allow an authenticated attacker to cause a limited denial of service and obtain very limited information about process memory layout due to an out-of-bounds read when processing a specially crafted client request.
Heap-based Buffer Overflow
IBM MQ Operator Unrestricted Java Deserialization (CVE-2026-12148)
CVE-2026-12148
7.5 - High
- October 19, 2026
IBM MQ Operator could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to unrestricted Java deserialization in the MQ Classes for Java.
Marshaling, Unmarshaling
IBM MQ Authenticated DoS via NULL Pointer Deref in Multicast Messages
CVE-2026-12155
6.5 - Medium
- October 19, 2026
IBM MQ could allow an authenticated attacker to cause a denial of service by sending specially crafted multicast status messages that trigger a NULL pointer dereference.
Marshaling, Unmarshaling
IBM MQ RFH2 Header Validation DoS in Queued Pub/Sub
CVE-2026-12343
6.5 - Medium
- October 19, 2026
IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of RFH2 message header fields in queued publish/subscribe operations.
Resource Exhaustion
IBM MQ Authenticated DoS via Crafted Async Consume Request
CVE-2026-12350
6.5 - Medium
- October 19, 2026
IBM MQ could allow an authenticated attacker to cause a denial of service by sending a specially crafted asynchronous consume request that crashes the queue manager agent process.
Marshaling, Unmarshaling
IBM MQ Web Console Authenticated Admin File Write via Path Validation Flaw
CVE-2026-12660
2.7 - Low
- October 19, 2026
IBM MQ Web Console could allow an authenticated administrator to write files outside the intended directory due to improper path validation.
Directory traversal
IBM MQ TLS DN Stack Buffer Overflow Enables Remote Code Exec
CVE-2026-12665
8.1 - High
- October 19, 2026
IBM MQ could allow a remote attacker to execute arbitrary code due to a stack buffer overflow when processing TLS certificates with malformed distinguished names during channel connection establishment.
Stack Overflow
IBM MQ OOB Read via Malformed Compressed Data (CVE-2026-12669)
CVE-2026-12669
3.1 - Low
- October 19, 2026
IBM MQ could allow an authenticated attacker to trigger a minor out-of-bounds read when sending malformed compressed data, though the data is not disclosed and the request is rejected.
Out-of-bounds Read
IBM MQ Off-by-One Buffer Overflow Allows Authenticated Process Instability
CVE-2026-12727
4.3 - Medium
- October 19, 2026
IBM MQ could allow an authenticated attacker to cause potential process instability due to an off-by-one buffer overflow when processing specially crafted object names.
off-by-five
IBM MQ Authenticated DoS via Excessive Memory Ops in Charset Conversion
CVE-2026-12670
5.3 - Medium
- October 19, 2026
IBM MQ could allow an authenticated attacker to cause a denial of service through a specially crafted message that triggers excessive memory operations during character set conversion.
Incorrect Conversion between Numeric Types
IBM MQ Operator Log Local File Read v3.2.0 to 3.2.23
CVE-2026-2607
5.1 - Medium
- May 27, 2026
IBM MQ Operator SC2: v3.2.0 through 3.2.23CD: v3.3.0, v3.4.0, v3.4.1, v3.5.0, v3.5.1 - v3.5.3, v3.6.0 - v3.6.4, v3.7.0 - v3.7.2, v3.8.0, v3.8.1, v3.9.0, v3.9.1LTS: v2.0.0 - 2.0.29 and IBM supplied MQ Advanced container images SC2: 9.4.0.6 through r1, 9.4.0.6-r2, 9.4.0.7-r1, 9.4.0.10-r1, 9.4.0.10-r2, 9.4.0.11-r1, 9.4.0.11-r2, 9.4.0.11-r3, 9.4.0.12-r1, 9.4.0.15-r1 - 9.4.0.15-r4, 9.4.0.16-r1, 9.4.0.16-r2, 9.4.0.17-r1, 9.4.0.17-r2, 9.4.0.20-r1CD: 9.4.1.0-r1, 9.4.1.0-r2, 9.4.1.1-r1, 9.4.2.0-r1, 9.4.2.0-r2, 9.4.2.1-r1, 9.4.2.1-r2, 9.4.3.0-r1, 9.4.3.0-r2, 9.4.3.1-r1 - 9.4.3.1-r3, 9.4.4.0-r1 - 9.4.4.0-r4, 9.4.4.1-r1, 9.4.5.0-r1, 9.4.5.0-r2LTS: 9.3.0.0-r1, 9.3.0.0-r2, 9.3.0.0-r3, 9.3.0.1-r1, 9.3.0.1-r2, 9.3.0.1-r3, 9.3.0.1-r4, 9.3.0.3-r1, 9.3.0.4-r1, 9.3.0.4-r2, 9.3.0.5-r1, 9.3.0.5-r2, 9.3.0.5-r3, 9.3.0.6-r1, 9.3.0.10-r1, 9.3.0.10-r2, 9.3.0.11-r1,9.3.0.11-r2, 9.3.0.15-r1, 9.3.0.16-r1, 9.3.0.16-r2, 9.3.0.17-r1, 9.3.0.17-r2, 9.3.0.17-r3, 9.3.0.20-r1, 9.3.0.20-r2, 9.3.0.21-r1, 9.3.0.21-r2, 9.3.0.21-r3, 9.3.0.25-r1, 9.4.0.0-r1, 9.4.0.0-r2, 9.4.0.0-r3, 9.4.0.5-r1, 9.4.0.5-r2 IBM MQ stores potentially sensitive information in log files that could be read by a local user.
Insertion of Sensitive Information into Log File
IBM MQ Operator (v3.2.03.8.1) Log Injection via Unescaped Log Messages
CVE-2025-12755
4 - Medium
- February 17, 2026
IBM MQ Operator (SC2 v3.2.03.8.1, LTS v2.0.02.0.29) and IBMsupplied MQ Advanced container images (across affected SC2, CD, and LTS 9.3.x9.4.x releases) contain a vulnerability where log messages are not properly neutralized before being written to log files. This flaw could allow an unauthorized user to inject malicious data into MQ log entries, potentially leading to misleading logs, log manipulation, or downstream logprocessing issues.
Improper Output Neutralization for Logs
Local Info Disclosure in IBM MQ Operator LTS 2.0.x–2.0.29, 3.x
CVE-2025-33013
6.2 - Medium
- July 24, 2025
IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0, and MQ Operator SC2 3.2.0 through 3.2.13 Container could disclose sensitive information to a local user due to improper clearing of heap memory before release.
Heap Inspection
IBM MQ Operator TLS cert validation flaw (ID) LTS 2.0.x, CD 3.0-3.1.3, SC2 3.2.x
CVE-2025-36005
5.9 - Medium
- July 24, 2025
IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0, and MQ Operator SC2 3.2.0 through 3.2.13 Internet Pass-Thru could allow a malicious user to obtain sensitive information from another TLS session connection by the proxy to the same hostname and port due to improper certificate validation.
Improper Certificate Validation
IBM MQ Operator (LTS 2.x, SC2 3.2.x, CD 3.x): Key Leak in HA CRR
CVE-2025-36041
4.7 - Medium
- June 15, 2025
IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1 through 3.5.3, and MQ Operator SC2 3.2.0 through 3.2.12 Native HA CRR could be configured with a private key and chain other than the intended key which could disclose sensitive information or allow the attacker to perform unauthorized actions.
Improper Certificate Validation
IBM MQ Operator SIGSEGV via AMQ RMPPA Channel (2.0.0-2.0.29, 3.0.0-3.5.1)
CVE-2025-27365
6.5 - Medium
- May 01, 2025
IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, and MQ Operator SC2 3.2.0 through 3.2.10 Client connecting to a MQ Queue Manager can cause a SIGSEGV in the AMQRMPPA channel process terminating it.
Dangling pointer
IBM MQ Container <3.1.3 Weak Crypto Decryption Vulnerability
CVE-2024-27256
7.5 - High
- January 27, 2025
IBM MQ Container 3.0.0, 3.0.1, 3.1.0 through 3.1.3 CD, 2.0.0 LTS through 2.0.22 LTS and 2.4.0 through 2.4.8, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
Use of a Broken or Risky Cryptographic Algorithm
IBM MQ 9.1-9.4 LTS/CD Auth Role Bypass to Execute Queue Manager Actions
CVE-2024-40681
8.8 - High
- September 07, 2024
IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow an authenticated user in a specifically defined role, to bypass security restrictions and execute actions against the queue manager.
Incorrect Privilege Assignment
IBM MQ 9.3/9.4 LTS/CD Local DoS via Improper Memory Allocation
CVE-2024-40680
5.5 - Medium
- September 07, 2024
IBM MQ 9.3 CD and 9.4 LTS/CD could allow a local user to cause a denial of service due to improper memory allocation causing a segmentation fault.
Allocation of Resources Without Limits or Throttling
IBM MQ Operator 3.2.2 / 2.0.24: Auth Bypass via Partial String Compare
CVE-2024-39742
9.8 - Critical
- July 08, 2024
IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 could allow a user to bypass authentication under certain configurations due to a partial string comparison vulnerability. IBM X-Force ID: 297169.
Incorrect Comparison
IBM MQ Operator 3.2.2 & 2.0.24 DoS via Incorrect Memory Deallocation
CVE-2024-39743
7.5 - High
- July 08, 2024
IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 IBM MQ Container Developer Edition is vulnerable to denial of service caused by incorrect memory de-allocation. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. IBM X-Force ID: 297172.
Amplification
IBM MQ Operator 2.0.03.0.1 LTS Stores Credentials in Cleartext (CVE202347745)
CVE-2023-47745
5.5 - Medium
- March 03, 2024
IBM MQ Operator 2.0.0 LTS, 2.0.18 LTS, 3.0.0 CD, 3.0.1 CD, 2.4.0 through 2.4.7, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2, and 2.3.0 through 2.3.3 stores or transmits user credentials in plain clear text which can be read by a local user using a trace command. IBM X-Force ID: 272638.
Cleartext Transmission of Sensitive Information
IBM MQ Operator Weak Crypto in v2.0.0v3.0.1
CVE-2024-27255
7.5 - High
- March 03, 2024
IBM MQ Operator 2.0.0 LTS, 2.0.18 LTS, 3.0.0 CD, 3.0.1 CD, 2.4.0 through 2.4.7, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2, and 2.3.0 through 2.3.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 283905.
Use of a Broken or Risky Cryptographic Algorithm
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for IBM Mq Operator or by IBM? Click the Watch button to subscribe.
