IBM MQ · CVE-2026-11376 · Infrastructure
FIX → 9.2.0.46 · 9.3.0.43 · 9.4.0.30 · 10.0.0.6 ✓ verified
IBM MQ mishandles subscription requests with crafted buffer size values, causing an integer overflow. An authenticated attacker can cause a denial of service or potentially execute arbitrary code on the queue manager.
first public Nov 4, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running IBM MQ queue managers (the Server component) on the listed versions, and IBM MQ Appliance on the listed firmware. An attacker needs valid credentials to send crafted subscription requests, so exposure is highest where many apps or partners can authenticate to the queue manager. IBM names denial of service and potentially code execution on the queue manager. Client-only installs are not listed as affected.
Not affected if client-only-install, no-authenticated-access, patched-version, unaffected-version
Who cares authenticated, enterprise, ibm-mq, messaging, self-hosted
dspmqver on each MQ server (or Appliance firmware version) and compare with the affected ranges: LTS, LTS, LTS, CD, LTS/CDIBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow when processing subscription requests with crafted buffer size values.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
9.2.0.0-9.2.0.449.3.0.0-9.3.0.429.4.0.0-9.4.0.269.4.0.0-9.4.5.110.0.0.0-10.0.0.59.4.0.0-9.4.0.26 LTS, 9.4.1.0-9.4.5.3 CD, 10.0.0.1-10.0.0.5Upgrade to 9.2.0.46 · 9.3.0.43 · 9.4.0.30 · 10.0.0.6
9.2.0.46. 9.3 LTS: 9.3.0.43. 9.4 LTS: fix pack 9.4.0.30. 10.0 LTS: 10.0.0.6. 9.4 CD and 10.0 CD: upgrade to 10.0.1.09.4.0.30; 10 LTS 10.0.0.6; 9.4 CD M2002 9.4.5.4; M2003 10.0.0.6 (APAR DT473422)