{"id":"CVE-2026-12343","kind":"vulnerability","aliases":["CVE-2026-12343"],"related":[],"title":"IBM MQ Operator: crafted RFH2 header can crash queued pub/sub","description":"IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of RFH2 message header fields in queued publish/subscribe operations.","summary":"IBM MQ Operator does not properly validate RFH2 message header fields in queued publish/subscribe operations. An authenticated attacker can send a crafted message to cause a denial of service.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ibm mq operator","fixed":[],"affected":">= 2.0.0, <= 2.0.29","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":">= 3.2.0, <= 3.2.29","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.3.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.4.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.4.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.3","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.3","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.4","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.7.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.7.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.7.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.8.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.8.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.9.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.9.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.9.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.3","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.4","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.1.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.1.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.2.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.2.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.3.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.3.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.4.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.4.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.5.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.5.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 10.0.0.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 10.0.0.5","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.3.0.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ibm-mq","kubernetes","messaging","vendor"],"not_affected_if":["unaffected-version"],"how_to_check":"- Check the installed IBM MQ Operator version against the affected ranges in the sources: `2.0.0` to `2.0.29`, `3.2.0` to `3.2.29`, and `3.3.0` to `3.6.2` (listed specific releases).\n- Confirm whether queued publish/subscribe is in use on affected queue managers (unknown from sources how to query this directly).","fix":"- Upgrade IBM MQ Operator to a fixed release. The sources do not name the fixed versions; see the IBM security bulletin for CVE-2026-12343.","status":"open","published_at":"2026-10-19T17:17:17+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T03:55:49+00:00","updated_at":"2026-10-25T03:55:49+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:55:49Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade IBM MQ Operator to a fixed release. The sources do not name the fixed versions; see the IBM security bulletin for CVE-2026-12343.","reach":"network","title":"IBM MQ Operator: crafted RFH2 header can crash queued pub/sub","impact":"low","summary":"IBM MQ Operator does not properly validate RFH2 message header fields in queued publish/subscribe operations. An authenticated attacker can send a crafted message to cause a denial of service.","category":"vendor","nicknames":[],"who_cares":["ibm-mq","kubernetes","messaging"],"confidence":0.6,"needs_auth":"yes","worst_case":"Authenticated attacker can crash or stall message processing, causing denial of service.","analyst_note":"Find the IBM security bulletin for CVE-2026-12343 to confirm the fixed versions and any configuration that gates the RFH2 path.","how_to_check":"- Check the installed IBM MQ Operator version against the affected ranges in the sources: `2.0.0` to `2.0.29`, `3.2.0` to `3.2.29`, and `3.3.0` to `3.6.2` (listed specific releases).\n- Confirm whether queued publish/subscribe is in use on affected queue managers (unknown from sources how to query this directly).","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Teams running IBM MQ Operator in the affected version ranges, where queued publish/subscribe traffic reaches the queue manager from authenticated clients. The sources do not say more about which deployments are most exposed. Teams on versions outside the listed ranges can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000669,"input_tokens":3615,"output_tokens":616,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-12343':13A,16A '-2026':12A,15A 'advanced':101A,107A,113A,119A,125A,131A,137A,143A,149A,155A,161A,167A,173A 'allow':214C 'attack':199B,217C 'authent':198B,216C 'caus':206B,219C 'container':102A,108A,114A,120A,126A,132A,138A,144A,150A,156A,162A,168A,174A 'could':213C 'craft':4A,203B 'crash':8A 'cve':11A,14A 'denial':208B,221C 'due':224C 'field':192B,232C 'header':6A,191B,231C 'ibm':1A,17A,20A,23A,26A,29A,32A,35A,38A,41A,44A,47A,50A,53A,56A,59A,62A,65A,68A,71A,74A,77A,80A,83A,86A,89A,92A,95A,98A,104A,110A,116A,122A,128A,134A,140A,146A,152A,158A,164A,170A,177B,182B,211C 'ibm-mq':176B 'images':103A,109A,115A,121A,127A,133A,139A,145A,151A,157A,163A,169A,175A 'improp':226C 'kubernet':179B 'messag':180B,190B,204B,230C 'mq':2A,18A,21A,24A,27A,30A,33A,36A,39A,42A,45A,48A,51A,54A,57A,60A,63A,66A,69A,72A,75A,78A,81A,84A,87A,90A,93A,96A,100A,106A,112A,118A,124A,130A,136A,142A,148A,154A,160A,166A,172A,178B,183B,212C 'oper':3A,184B,196B,236C 'operator':19A,22A,25A,28A,31A,34A,37A,40A,43A,46A,49A,52A,55A,58A,61A,64A,67A,70A,73A,76A,79A,82A,85A,88A,91A,94A,97A 'proper':187B 'pub/sub':10A 'publish/subscribe':195B,235C 'queu':9A,194B,234C 'rfh2':5A,189B,229C 'send':201B 'servic':210B,223C 'supplied':99A,105A,111A,117A,123A,129A,135A,141A,147A,153A,159A,165A,171A 'valid':188B,227C 'vendor':181B","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM MQ Operator in the affected version ranges, where queued publish/subscribe traffic reaches the queue manager from authenticated clients. The sources do not say more about which deployments are most exposed. Teams on versions outside the listed ranges can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T17:17:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-12343","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12343","severity":null,"published_at":"2026-10-19T17:17:17+00:00","modified_at":"2026-10-23T17:27:38+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}