CVE-2026-14511: IBM MQ DOS Vulnerability

CVE-2026-14511 Overview

CVE-2026-14511 affects IBM MQ versions 9.4.5.0 through 9.4.5.1. An authenticated user can send a specially crafted message that crashes consuming applications, resulting in denial of service. The vulnerability is classified under CWE-770: Allocation of Resources Without Limits or Throttling. Attackers exploit this flaw remotely over the network with low privileges and no user interaction. Successful exploitation disrupts message processing without compromising confidentiality or integrity.

Critical Impact
An authenticated attacker can crash downstream consuming applications by delivering a malformed message, interrupting business-critical message queuing workflows.

Affected Products

IBM MQ 9.4.5.0
IBM MQ 9.4.5.1
IBM MQ 9.4.5.x deployments on supported platforms

Discovery Timeline

2026-10-19 - CVE-2026-14511 published to NVD
2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-14511

Vulnerability Analysis

IBM MQ is an enterprise messaging middleware used to transfer data between applications and systems. This vulnerability resides in message handling logic that fails to enforce bounds on inbound message content. When a consumer application retrieves the crafted message from the queue, the processing path triggers a crash. The result is a denial of service affecting any client subscribing to or consuming from the targeted queue.

The flaw requires authentication but no elevated privileges. Any user with permission to publish messages to a queue can trigger the condition. Because MQ is commonly used in financial, logistics, and healthcare transaction pipelines, downstream outages can cascade across dependent services.

Root Cause

The root cause maps to [CWE-770], the absence of resource allocation limits or validation on specific message fields. The consuming application path does not safely handle the crafted input, leading to an unhandled fault during message parsing or deserialization. IBM has not published the specific internal field or structure affected.

Attack Vector

The attack vector is network-based. An authenticated user transmits a specially crafted message to an IBM MQ queue. When the receiving application calls MQGET or an equivalent consumer API to retrieve the message, the processing crashes. The attacker does not need direct access to the consuming application. Repeated exploitation can keep consumers in a crash-restart loop, prolonging the outage.

No public proof-of-concept exploit code is available. Refer to the IBM Security Advisory for vendor-provided technical details.

Detection Methods for CVE-2026-14511

Indicators of Compromise

Unexpected termination or repeated restarts of IBM MQ consumer applications processing specific queues.
Error logs indicating malformed message content or parsing exceptions during MQGET operations.
Spikes in dead-letter queue activity correlated with crashed consumers.
Message publication from accounts with no legitimate business need to post to the affected queue.

Detection Strategies

Monitor IBM MQ queue manager error logs (AMQERR01.LOG) for FFST (First Failure Support Technology) records tied to consumer crashes.
Correlate authentication events with message publication patterns to identify low-privilege accounts producing anomalous payloads.
Baseline normal message size and structure per queue, and alert on outliers that precede application crashes.

Monitoring Recommendations

Enable MQ channel authentication records and audit logging for all PUT operations on sensitive queues.
Forward MQ error logs and application crash telemetry to a centralized SIEM for correlation.
Track consumer application uptime and restart frequency as a health signal for queue abuse.

How to Mitigate CVE-2026-14511

Immediate Actions Required

Inventory all IBM MQ deployments to identify instances running versions 9.4.5.0 or 9.4.5.1.
Apply the vendor-supplied fix referenced in the IBM Security Advisory.
Review and restrict queue-level authorization so only required principals can publish to critical queues.
Audit recent authentication events for the affected queue managers to identify suspicious publishers.

Patch Information

IBM has published remediation guidance in the IBM Security Advisory. Administrators should upgrade to the fixed IBM MQ release identified in that advisory. Verify patch deployment across both queue managers and client installations.

Workarounds

Apply least-privilege access controls on queues using setmqaut to limit PUT permissions to trusted service accounts.
Enable TLS and mutual authentication on channels to reduce the authenticated attack surface.
Implement message validation at the application layer to reject unexpected payload structures before processing.
Deploy automated restart and circuit-breaker logic in consumer applications to limit outage duration if exploitation occurs.

bash

# Example: restrict PUT authority on a queue to a specific service account
setmqaut -m QMGR1 -n APP.QUEUE.IN -t queue -p svc_producer +put
setmqaut -m QMGR1 -n APP.QUEUE.IN -t queue -p 'group:all' -put -browse -get