Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2026-12350

IBM MQ Deserialization of Untrusted Data

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
ibm

Description

IBM MQ could allow an authenticated attacker to cause a denial of service by sending a specially crafted asynchronous consume request that crashes the queue manager agent process.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

IBM MQ Operator

Default version status: unaffected

  • 3.2.0 to ≤ 3.2.29affected
  • 3.3.0 to < 3.4.0affected
  • 3.4.1affected
  • 3.5.0affected
  • 3.5.1 to ≤ 3.5.3affected
  • 3.6.0 to ≤ 3.6.4affected
  • 3.7.0 to ≤ 3.7.2affected
  • 3.8.0affected
  • 3.8.1affected
  • 3.9.0affected
  • 3.9.1affected
  • 3.9.2affected
  • 4.0.0affected
  • 4.0.1affected
  • 4.0.2affected
  • 4.0.3affected
  • 4.0.4affected
  • 2.0.0 to ≤ 2.0.29affected

IBM MQ Advanced container images

Default version status: unaffected

  • 9.4.0.6-r1 to ≤ r1, 9.4.0.6-r2, 9.4.0.7-r1, 9.4.0.10-r1, 9.4.0.10-r2, 9.4.0.11-r1, 9.4.0.11-r2, 9.4.0.11-r3, 9.4.0.12-r1, 9.4.0.15-r1 - 9.4.0.15-r4, 9.4.0.16-r1, 9.4.0.16-r2, 9.4.0.17-r1, 9.4.0.17-r2, 9.4.0.20-r1, 9.4.0.21-r1, 9.4.0.21-r2, 9.4.0.25-r1 - 9.4.0.25-r3, 9.4.0.26-r1CD: 9.4.1.0-r1, 9.4.1.0-r2, 9.4.1.1-r1, 9.4.2.0-r1, 9.4.2.0-r2, 9.4.2.1-r1, 9.4.2.1-r2, 9.4.3.0-r1, 9.4.3.0-r2, 9.4.3.1-r1 - 9.4.3.1-r3, 9.4.4.0-r1 - 9.4.4.0-r4, 9.4.4.1-r1, 9.4.5.0-r1, 9.4.5.0-r2, 9.4.5.1-r1, 10.0.0.0-r1 - 10.0.0.0-r4, 10.0.0.5-r1LTS: 9.3.0.0-r1, 9.3.0.0-r2, 9.3.0.0-r3, 9.3.0.1-r1, 9.3.0.1-r2, 9.3.0.1-r3, 9.3.0.1-r4, 9.3.0.3-r1, 9.3.0.4-r1, 9.3.0.4-r2, 9.3.0.5-r1, 9.3.0.5-r2, 9.3.0.5-r3, 9.3.0.6-r1, 9.3.0.10-r1, 9.3.0.10-r2, 9.3.0.11-r1,9.3.0.11-r2, 9.3.0.15-r1, 9.3.0.16-r1, 9.3.0.16-r2, 9.3.0.17-r1, 9.3.0.17-r2, 9.3.0.17-r3, 9.3.0.20-r1, 9.3.0.20-r2, 9.3.0.21-r1, 9.3.0.21-r2, 9.3.0.21-r3, 9.3.0.25-r1, 9.4.0.0-r1, 9.4.0.0-r2, 9.4.0.0-r3, 9.4.0.5-r1, 9.4.0.5-r2affected
  • 9.4.0.6-r2affected
  • 9.4.0.7-r1affected
  • 9.4.0.10-r1affected
  • 9.4.0.10-r2affected
  • 9.4.0.11-r1affected
  • 9.4.0.11-r2affected
  • 9.4.0.11-r3affected
  • 9.4.0.12-r1affected
  • 9.4.0.15-r1 to ≤ 9.4.0.15-r4affected
  • 9.4.0.16-r1affected
  • 9.4.0.16-r2affected
  • 9.4.0.17-r1affected
  • 9.4.0.17-r2affected
  • 9.4.0.20-r1affected
  • 9.4.0.21-r1affected
  • 9.4.0.21-r2affected
  • 9.4.0.25-r1 to ≤ 9.4.0.25-r3affected
  • 9.4.0.26-r1affected
  • 9.4.1.0-r1affected
  • 9.4.1.0-r2affected
  • 9.4.1.1-r1affected
  • 9.4.2.0-r1affected
  • 9.4.2.0-r2affected
  • 9.4.2.1-r1affected
  • 9.4.2.1-r2affected
  • 9.4.3.0-r1affected
  • 9.4.3.0-r2affected
  • 9.4.3.1-r1 to ≤ 9.4.3.1-r3affected
  • 9.4.4.0-r1affected
  • 9.4.4.1-r1affected
  • 9.4.5.0-r1affected
  • 9.4.5.0-r2affected
  • 9.4.5.1-r1affected
  • 10.0.0.0-r1 to ≤ 10.0.0.0-r4affected
  • 10.0.0.5-r1affected
  • 9.3.0.0-r1affected
  • 9.3.0.0-r2affected
  • 9.3.0.0-r3affected
  • 9.3.0.1-r1affected
  • 9.3.0.1-r2affected
  • 9.3.0.1-r3affected
  • 9.3.0.1-r4affected
  • 9.3.0.3-r1affected
  • 9.3.0.4-r1affected
  • 9.3.0.4-r2affected
  • 9.3.0.5-r1affected
  • 9.3.0.5-r2affected
  • 9.3.0.5-r3affected
  • 9.3.0.6-r1affected
  • 9.3.0.10-r1affected
  • 9.3.0.10-r2affected
  • 9.3.0.11-r1affected
  • 9.3.0.11-r2affected
  • 9.3.0.15-r1affected
  • 9.3.0.16-r1affected
  • 9.3.0.16-r2affected
  • 9.3.0.17-r1affected
  • 9.3.0.17-r2affected
  • 9.3.0.17-r3affected
  • 9.3.0.20-r1affected
  • 9.3.0.20-r2affected
  • 9.3.0.21-r1affected
  • 9.3.0.21-r2affected
  • 9.3.0.21-r3affected
  • 9.3.0.25-r1affected
  • 9.4.0.0-r1affected
  • 9.4.0.0-r2affected
  • 9.4.0.0-r3affected
  • 9.4.0.5-r1affected
  • 9.4.0.5-r2affected

References