CVE-2026-11829: IBM MQ DOS Vulnerability via MQOPEN Requests

CVE-2026-11829 Overview

CVE-2026-11829 is a denial of service vulnerability in IBM MQ. The flaw stems from improper validation of offset values in MQOPEN requests. An authenticated attacker with network access to the message queue manager can send a crafted request that disrupts service availability. The vulnerability is tracked under CWE-120, classic buffer copy without checking input size.

Critical Impact
An authenticated remote attacker can trigger a denial of service condition against IBM MQ, interrupting message processing for all connected applications and downstream systems that depend on the queue manager.

Affected Products

IBM MQ (specific versions listed in the IBM Support advisory)

Discovery Timeline

2026-10-19 - CVE-2026-11829 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-11829

Vulnerability Analysis

IBM MQ provides messaging middleware used by enterprises to exchange data between applications across distributed systems. Clients interact with queues through the Message Queue Interface (MQI), where the MQOPEN call establishes a handle to a queue, topic, or other MQ object before messages are placed or retrieved.

CVE-2026-11829 affects how the queue manager processes offset fields contained in MQOPEN requests. Insufficient validation of these offset values allows an authenticated client to submit values that fall outside expected boundaries. Processing the malformed request causes the queue manager to terminate or become unresponsive.

An attacker needs valid credentials and network access to the queue manager listener. User interaction is not required. The impact is limited to availability; confidentiality and integrity of messages are not directly affected. Repeated exploitation can halt message delivery across business-critical workflows that rely on IBM MQ for transactional messaging.

Root Cause

The root cause is improper input validation in the handling of offset parameters within MQOPEN requests. The code path does not enforce bounds checks on offset values before using them in memory operations, matching the pattern described by CWE-120. When an out-of-range offset is supplied, the queue manager process can crash or enter a state that prevents further request processing.

Attack Vector

Exploitation requires network connectivity to the IBM MQ listener and a valid authenticated session. The attacker constructs an MQOPEN request with manipulated offset fields and sends it to the queue manager. The queue manager fails to validate the offsets and encounters a condition that results in a denial of service. Refer to the IBM Support advisory for product-specific technical details.

Detection Methods for CVE-2026-11829

Indicators of Compromise

Unexpected AMQ error messages or FFST (First Failure Support Technology) files generated by the queue manager process.
Abnormal termination or restart events for the amqzxma0 or runmqlsr processes.
Message processing stalls or disconnected client applications correlated with specific authenticated sessions.

Detection Strategies

Monitor IBM MQ error logs (AMQERR01.LOG) for repeated MQOPEN failures tied to a single authenticated user or source address.
Alert on queue manager process crashes and automated restart cycles.
Correlate authentication events with abnormal MQI call patterns to identify abusive clients.

Monitoring Recommendations

Forward IBM MQ logs and FFST dumps into a centralized SIEM for correlation and alerting.
Baseline normal MQOPEN request volumes per client identity and alert on deviations.
Track queue manager uptime and availability metrics to detect repeated denial of service attempts.

How to Mitigate CVE-2026-11829

Immediate Actions Required

Review the IBM Support advisory and identify affected IBM MQ versions in your environment.
Apply the vendor-supplied patch or interim fix to all affected queue managers as soon as it is validated.
Audit MQ user accounts and revoke credentials that are no longer required to reduce the authenticated attack surface.

Patch Information

IBM has published remediation details on the IBM Support page for this issue. Administrators should apply the fix pack or interim fix referenced in that advisory. Verify queue manager version using dspmqver after patching to confirm the update is in place.

Workarounds

Restrict network access to the IBM MQ listener using firewall rules so only trusted hosts can reach the queue manager.
Enforce channel authentication records (CHLAUTH) to limit which users and IP ranges can connect.
Monitor and rate-limit MQOPEN activity from individual client identities until the patch is applied.