Executive brief
IBM MQ is a widely-used enterprise messaging system that handles secure message queuing across distributed systems. This vulnerability allows an attacker with a malicious TLS certificate to trigger uncontrolled recursion in the certificate validation logic, causing the queue manager to crash or become unstable. Organizations using MQ for critical messaging infrastructure face potential service disruption and data loss.
Technical details
The vulnerability is an unbounded recursion flaw (CWE-121 stack-based buffer overflow) in IBM MQ's TLS certificate parser. When processing deeply nested certificate data structures, the parser fails to properly validate recursion depth, allowing stack exhaustion. An attacker with a trusted/valid TLS client certificate can craft a certificate with pathologically deep nesting to trigger the condition. The attack requires network access to the queue manager's TLS port and a valid certificate, but no authentication or user interaction. Successful exploitation causes denial of service and may corrupt memory contents. Patches are available as cumulative security updates for all affected LTS and CD branches.
Affected products
- IBM MQ 9.1.0.0 through 9.1.0.37 LTS
- IBM MQ 9.2.0.0 through 9.2.0.43 LTS
- IBM MQ 9.3.0.0 through 9.3.0.41 LTS
- IBM MQ 9.3.0.0 through 9.3.5.1 CD
- IBM MQ 9.4.0.0 through 9.4.0.25 LTS
- IBM MQ 9.4.0.0 through 9.4.5.1 CD
- IBM MQ 10.0.0.0
Timeline
- 2026-09-14: disclosed