{"id":"CVE-2026-11828","kind":"vulnerability","aliases":["CVE-2026-11828"],"related":[],"title":"IBM MQ Operator: oversized queue name length crashes asynchronous clients","description":"IBM MQ could allow a remote attacker with queue manager control or man-in-the-middle access on unencrypted channels to cause a denial of service in client applications using asynchronous message consumption due to improper validation of queue name length values.","summary":"IBM MQ does not properly validate queue name length values, so a remote attacker with queue manager control or man-in-the-middle access on an unencrypted channel can crash client applications that consume messages asynchronously. The result is a denial of service, not code execution or data theft.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ibm mq operator","fixed":[],"affected":">= 2.0.0, <= 2.0.29","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":">= 3.2.0, <= 3.2.29","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.3.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.4.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.4.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.3","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.3","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.4","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.7.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.7.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.7.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.8.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.8.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.9.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.9.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.9.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.3","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.4","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.1.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.1.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.2.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.2.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.3.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.3.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.4.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.4.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.5.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.5.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 10.0.0.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 10.0.0.5","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.3.0.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ibm-mq","kubernetes","messaging","vendor"],"not_affected_if":["no-async-consumers","operator-not-deployed","tls-channels"],"how_to_check":"- Check the installed IBM MQ Operator version with `kubectl get csv -A | grep -i mq` or the operator's deployed image tag\n- Confirm whether client channels are unencrypted (TLS not configured on the channel) in the queue manager channel definitions\n- unknown for other checks","fix":"- Upgrade the IBM MQ Operator to a fixed release for your line; the fixed versions are not stated in the sources (fixed ? in NVD listing), so check the IBM security bulletin\n- Enable TLS on MQ channels so man-in-the-middle access is not possible\n- unknown for fixed version numbers","status":"open","published_at":"2026-10-19T17:17:16+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T04:08:47+00:00","updated_at":"2026-10-25T04:08:47+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T04:08:47Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the IBM MQ Operator to a fixed release for your line; the fixed versions are not stated in the sources (fixed ? in NVD listing), so check the IBM security bulletin\n- Enable TLS on MQ channels so man-in-the-middle access is not possible\n- unknown for fixed version numbers","reach":"network","title":"IBM MQ Operator: oversized queue name length crashes asynchronous clients","impact":"low","summary":"IBM MQ does not properly validate queue name length values, so a remote attacker with queue manager control or man-in-the-middle access on an unencrypted channel can crash client applications that consume messages asynchronously. The result is a denial of service, not code execution or data theft.","category":"vendor","nicknames":[],"who_cares":["ibm-mq","kubernetes","messaging"],"confidence":0.6,"needs_auth":"yes","worst_case":"Client applications consuming messages asynchronously crash, causing denial of service","analyst_note":"Find the fixed operator versions for each affected line in the IBM security bulletin, since NVD lists fixed as unknown.","how_to_check":"- Check the installed IBM MQ Operator version with `kubectl get csv -A | grep -i mq` or the operator's deployed image tag\n- Confirm whether client channels are unencrypted (TLS not configured on the channel) in the queue manager channel definitions\n- unknown for other checks","needs_analyst":true,"not_affected_if":["tls-channels","no-async-consumers","operator-not-deployed"],"who_is_affected":"Teams running the IBM MQ Operator in the affected ranges (2.0.0 to 2.0.29, 3.2.0 to 3.2.29, and 3.3.0 to 3.6.2 specific releases) whose client applications consume messages asynchronously. Exposure is higher where channels run unencrypted and someone on the path or with queue manager control can send crafted queue names. Teams that only run encrypted channels or do not use the operator can likely skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000728,"input_tokens":3636,"output_tokens":728,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-11828':13A,16A '-2026':12A,15A 'access':206B,249C 'advanced':101A,107A,113A,119A,125A,131A,137A,143A,149A,155A,161A,167A,173A 'allow':235C 'applic':214B,261C 'asynchron':9A,218B,263C 'attack':195B,238C 'caus':254C 'channel':210B,252C 'client':10A,213B,260C 'code':227B 'consum':216B 'consumpt':265C 'container':102A,108A,114A,120A,126A,132A,138A,144A,150A,156A,162A,168A,174A 'control':199B,242C 'could':234C 'crash':8A,212B 'cve':11A,14A 'data':230B 'denial':223B,256C 'due':266C 'execut':228B 'ibm':1A,17A,20A,23A,26A,29A,32A,35A,38A,41A,44A,47A,50A,53A,56A,59A,62A,65A,68A,71A,74A,77A,80A,83A,86A,89A,92A,95A,98A,104A,110A,116A,122A,128A,134A,140A,146A,152A,158A,164A,170A,177B,182B,232C 'ibm-mq':176B 'images':103A,109A,115A,121A,127A,133A,139A,145A,151A,157A,163A,169A,175A 'improp':268C 'kubernet':179B 'length':7A,190B,273C 'man':202B,245C 'man-in-the-middl':201B,244C 'manag':198B,241C 'messag':180B,217B,264C 'middl':205B,248C 'mq':2A,18A,21A,24A,27A,30A,33A,36A,39A,42A,45A,48A,51A,54A,57A,60A,63A,66A,69A,72A,75A,78A,81A,84A,87A,90A,93A,96A,100A,106A,112A,118A,124A,130A,136A,142A,148A,154A,160A,166A,172A,178B,183B,233C 'name':6A,189B,272C 'oper':3A 'operator':19A,22A,25A,28A,31A,34A,37A,40A,43A,46A,49A,52A,55A,58A,61A,64A,67A,70A,73A,76A,79A,82A,85A,88A,91A,94A,97A 'overs':4A 'proper':186B 'queue':5A,188B,197B,240C,271C 'remot':194B,237C 'result':220B 'servic':225B,258C 'supplied':99A,105A,111A,117A,123A,129A,135A,141A,147A,153A,159A,165A,171A 'theft':231B 'unencrypt':209B,251C 'use':262C 'valid':187B,269C 'valu':191B,274C 'vendor':181B","nicknames":[],"mitigations":[],"who_affected":"Teams running the IBM MQ Operator in the affected ranges (2.0.0 to 2.0.29, 3.2.0 to 3.2.29, and 3.3.0 to 3.6.2 specific releases) whose client applications consume messages asynchronously. Exposure is higher where channels run unencrypted and someone on the path or with queue manager control can send crafted queue names. Teams that only run encrypted channels or do not use the operator can likely skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T17:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-11828","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11828","severity":null,"published_at":"2026-10-19T17:17:16+00:00","modified_at":"2026-10-23T15:23:08+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}