CVE-2024-25016: IBM MQ DOS Vulnerability

CVE-2024-25016 Overview

CVE-2024-25016 affects IBM MQ and IBM MQ Appliance versions 9.0, 9.1, 9.2, 9.3 LTS, and 9.3 CD. The vulnerability stems from incorrect buffering logic in the message queue server. A remote unauthenticated attacker can exploit this flaw to cause a denial of service condition on affected systems. IBM tracks this issue under X-Force ID 281279. The vulnerability maps to [CWE-20] Improper Input Validation. Because IBM MQ underpins critical messaging infrastructure across financial services, government, and enterprise environments, an availability impact can disrupt downstream business processes.

Critical Impact
A remote unauthenticated attacker can trigger a denial of service condition against IBM MQ queue managers over the network, disrupting messaging infrastructure without requiring credentials or user interaction.

Affected Products

IBM MQ 9.0, 9.1, 9.2, 9.3 LTS
IBM MQ 9.3 CD (Continuous Delivery)
IBM MQ Appliance 9.0, 9.1, 9.2, 9.3 LTS and 9.3 CD

Discovery Timeline

2024-03-03 - CVE-2024-25016 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-25016

Vulnerability Analysis

The vulnerability resides in the buffering logic used by IBM MQ to process incoming network messages. Incorrect handling of buffered data allows an attacker to send a crafted request that destabilizes the queue manager process. The exploitation requires no authentication and no user interaction, lowering the bar for attack. Successful exploitation results in service disruption rather than data exposure or integrity loss. The confidentiality and integrity of messages handled by the queue manager remain unaffected by this specific issue.

Root Cause

The root cause is improper input validation [CWE-20] within the message buffering path. IBM's advisory describes the defect as incorrect buffering logic. When the affected component processes malformed or unexpected message structures, the flawed logic produces a fault condition that terminates or hangs the queue manager process. The defect affects multiple long-term support and continuous delivery branches, indicating shared code across IBM MQ releases.

Attack Vector

The attack vector is network-based. An attacker reaches the listener port of an IBM MQ queue manager — typically TCP/1414 — and submits a malformed protocol message. No authentication is required because the defect triggers before authentication completes. Internet-exposed MQ listeners and flat internal networks both present viable attack surfaces. Refer to the IBM Support Node Advisory and the IBM X-Force Vulnerability #281279 for vendor technical details.

No public proof-of-concept code is available. The vulnerability mechanism is described in prose because verified exploit code has not been released.

Detection Methods for CVE-2024-25016

Indicators of Compromise

Unexpected termination or restart of IBM MQ queue manager processes (amqzmuc0, amqzxma0, runmqlsr).
FDC (First Failure Data Capture) files generated in /var/mqm/errors/ correlating with inbound client connections.
Spikes in TCP connections to MQ listener ports (default 1414) from unusual source addresses.
Queue manager error logs containing AMQ9999 or abnormal termination entries near the time of disruption.

Detection Strategies

Monitor IBM MQ error logs (AMQERR01.LOG) for abnormal channel termination patterns and repeated client connection failures.
Deploy IDS/IPS signatures that flag malformed MQ protocol headers reaching listener ports.
Correlate queue manager service restarts with network telemetry to identify the originating client.
Track listener availability through synthetic monitoring to detect outage windows quickly.

Monitoring Recommendations

Baseline normal connection rates and message sizes per channel, then alert on deviations.
Forward MQ error logs and operating system audit logs to a centralized SIEM for correlation.
Enable MQ event messages on the SYSTEM.ADMIN.CHANNEL.EVENT queue to capture channel start/stop events.
Review network firewall logs for connections to TCP/1414 originating outside expected application tiers.

How to Mitigate CVE-2024-25016

Immediate Actions Required

Apply the IBM fix referenced in the IBM Support Node Advisory to all affected queue managers and MQ Appliances.
Inventory all IBM MQ instances and confirm versions against the affected list (9.0, 9.1, 9.2, 9.3 LTS, 9.3 CD).
Restrict network access to MQ listener ports so only authorized application hosts can connect.
Increase monitoring on queue manager availability and error logs until patches are deployed.

Patch Information

IBM has published remediation guidance in the IBM Support Node Advisory. Customers should upgrade to the fixed fix-pack or CD release identified by IBM for their specific MQ version. The corresponding X-Force entry is available at IBM X-Force Vulnerability #281279. EPSS data places exploitation probability at 0.849% as of 2026-06-23.

Workarounds

Place IBM MQ queue managers behind a firewall that permits inbound connections only from known application hosts.
Terminate untrusted TLS connections at a reverse proxy or MQ channel security exit that performs early validation.
Disable or restrict access to channels not in active use to reduce attack surface.
Enforce Channel Authentication Records (CHLAUTH) to limit which client identities and addresses may connect.

bash

# Example: Restrict MQ channel access using CHLAUTH rules
runmqsc QM1 <<EOF
SET CHLAUTH('*') TYPE(ADDRESSMAP) ADDRESS('*') USERSRC(NOACCESS) ACTION(REPLACE)
SET CHLAUTH('APP.SVRCONN') TYPE(ADDRESSMAP) ADDRESS('10.10.20.0/24') USERSRC(CHANNEL) ACTION(REPLACE)
REFRESH SECURITY TYPE(CONNAUTH)
EOF