{"id":"CVE-2026-11831","kind":"vulnerability","aliases":["CVE-2026-11831"],"related":[],"title":"IBM MQ Operator: crafted client request causes limited denial of service","description":"IBM MQ could allow an authenticated attacker to cause a limited denial of service and obtain very limited information about process memory layout due to an out-of-bounds read when processing a specially crafted client request.","summary":"An out-of-bounds read in IBM MQ Operator lets an authenticated client send a crafted request that causes a limited denial of service. The same flaw reveals very limited information about process memory layout.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ibm mq operator","fixed":[],"affected":">= 2.0.0, <= 2.0.29","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":">= 3.2.0, <= 3.2.29","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.3.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.4.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.4.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.3","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.3","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.4","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.7.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.7.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.7.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.8.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.8.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.9.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.9.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.9.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.3","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.4","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.1.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.1.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.2.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.2.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.3.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.3.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.4.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.4.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.5.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.5.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 10.0.0.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 10.0.0.5","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.3.0.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ibm-mq","kubernetes","messaging","vendor"],"not_affected_if":["unauthenticated-only-access"],"how_to_check":"- Check the installed IBM MQ Operator version against the affected ranges: `2.0.0` to `2.0.29`, `3.2.0` to `3.2.29`, and exactly `3.3.0`, `3.4.0`, `3.4.1`, `3.5.0` to `3.5.3`, `3.6.0` to `3.6.2`.\n- Confirm the operator version with the cluster's installed operator listing (for example `kubectl get csv` in the operator namespace), if the team runs it on Kubernetes.","fix":"- Move the IBM MQ Operator to a fixed release. The sources do not list the fixed version numbers, so check the IBM security bulletin for CVE-2026-11831.","status":"open","published_at":"2026-10-19T17:17:16+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T04:16:43+00:00","updated_at":"2026-10-25T04:16:43+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T04:16:43Z","model":"claude-haiku-5-5","output":{"fix":"- Move the IBM MQ Operator to a fixed release. The sources do not list the fixed version numbers, so check the IBM security bulletin for CVE-2026-11831.","reach":"network","title":"IBM MQ Operator: crafted client request causes limited denial of service","impact":"low","summary":"An out-of-bounds read in IBM MQ Operator lets an authenticated client send a crafted request that causes a limited denial of service. The same flaw reveals very limited information about process memory layout.","category":"vendor","nicknames":[],"who_cares":["ibm-mq","kubernetes","messaging"],"confidence":0.6,"needs_auth":"yes","worst_case":"Limited service disruption and very limited process memory layout leak.","analyst_note":"Fixed versions are not listed in the sources; check the IBM security bulletin for CVE-2026-11831 to confirm the fixed release for each branch.","how_to_check":"- Check the installed IBM MQ Operator version against the affected ranges: `2.0.0` to `2.0.29`, `3.2.0` to `3.2.29`, and exactly `3.3.0`, `3.4.0`, `3.4.1`, `3.5.0` to `3.5.3`, `3.6.0` to `3.6.2`.\n- Confirm the operator version with the cluster's installed operator listing (for example `kubectl get csv` in the operator namespace), if the team runs it on Kubernetes.","needs_analyst":true,"not_affected_if":["unauthenticated-only-access"],"who_is_affected":"Teams that run IBM MQ Operator in the affected version ranges and accept client connections from authenticated users. Exposure depends on who can send requests to the queue manager, so teams with no authenticated client access have less reason to worry. The sources do not say whether the default configuration is affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000693,"input_tokens":3621,"output_tokens":662,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-11831':14A,17A '-2026':13A,16A 'advanced':102A,108A,114A,120A,126A,132A,138A,144A,150A,156A,162A,168A,174A 'allow':222C 'attack':225C 'authent':195B,224C 'bound':187B,248C 'caus':7A,202B,227C 'client':5A,196B,255C 'container':103A,109A,115A,121A,127A,133A,139A,145A,151A,157A,163A,169A,175A 'could':221C 'craft':4A,199B,254C 'cve':12A,15A 'denial':9A,205B,230C 'due':242C 'flaw':210B 'ibm':1A,18A,21A,24A,27A,30A,33A,36A,39A,42A,45A,48A,51A,54A,57A,60A,63A,66A,69A,72A,75A,78A,81A,84A,87A,90A,93A,96A,99A,105A,111A,117A,123A,129A,135A,141A,147A,153A,159A,165A,171A,178B,190B,219C 'ibm-mq':177B 'images':104A,110A,116A,122A,128A,134A,140A,146A,152A,158A,164A,170A,176A 'inform':214B,237C 'kubernet':180B 'layout':218B,241C 'let':193B 'limit':8A,204B,213B,229C,236C 'memori':217B,240C 'messag':181B 'mq':2A,19A,22A,25A,28A,31A,34A,37A,40A,43A,46A,49A,52A,55A,58A,61A,64A,67A,70A,73A,76A,79A,82A,85A,88A,91A,94A,97A,101A,107A,113A,119A,125A,131A,137A,143A,149A,155A,161A,167A,173A,179B,191B,220C 'obtain':234C 'oper':3A,192B 'operator':20A,23A,26A,29A,32A,35A,38A,41A,44A,47A,50A,53A,56A,59A,62A,65A,68A,71A,74A,77A,80A,83A,86A,89A,92A,95A,98A 'out-of-bound':184B,245C 'process':216B,239C,251C 'read':188B,249C 'request':6A,200B,256C 'reveal':211B 'send':197B 'servic':11A,207B,232C 'special':253C 'supplied':100A,106A,112A,118A,124A,130A,136A,142A,148A,154A,160A,166A,172A 'vendor':182B","nicknames":[],"mitigations":[],"who_affected":"Teams that run IBM MQ Operator in the affected version ranges and accept client connections from authenticated users. Exposure depends on who can send requests to the queue manager, so teams with no authenticated client access have less reason to worry. The sources do not say whether the default configuration is affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T17:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-11831","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11831","severity":null,"published_at":"2026-10-19T17:17:16+00:00","modified_at":"2026-10-23T21:00:09+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}