{"id":"CVE-2026-14511","kind":"vulnerability","aliases":["CVE-2026-14511"],"related":[],"title":"IBM MQ: crafted message from authenticated user crashes consuming applications","description":"IBM MQ 9.4.5.0 through 9.4.5.1 could allow an authenticated user to cause a denial of service by sending a specially crafted message that crashes consuming applications.","summary":"IBM MQ versions 9.4.5.0 through 9.4.5.1 can be crashed by a specially crafted message sent by an authenticated user. The crash affects applications that consume the message, causing a denial of service.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ibm mq","fixed":[],"affected":"= 9.4.5.0","ecosystem":"vendor"},{"name":"ibm mq","fixed":[],"affected":"= 9.4.5.1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ibm-mq","messaging","queue-consumers","vendor"],"not_affected_if":["other-mq-versions"],"how_to_check":"- Run `dspmqver` on the queue manager host and compare the reported version against `9.4.5.0` and `9.4.5.1`\n- unknown for other checks: the sources do not say which configurations expose the consuming applications","fix":"- Move IBM MQ to a release after `9.4.5.1` as listed in the IBM advisory (fixed version not named in the sources)\n- unknown for interim mitigations: the sources do not say","status":"open","published_at":"2026-10-19T17:17:20+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T03:55:46+00:00","updated_at":"2026-10-25T03:55:46+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:55:46Z","model":"claude-haiku-5-5","output":{"fix":"- Move IBM MQ to a release after `9.4.5.1` as listed in the IBM advisory (fixed version not named in the sources)\n- unknown for interim mitigations: the sources do not say","reach":"network","title":"IBM MQ: crafted message from authenticated user crashes consuming applications","impact":"low","summary":"IBM MQ versions 9.4.5.0 through 9.4.5.1 can be crashed by a specially crafted message sent by an authenticated user. The crash affects applications that consume the message, causing a denial of service.","category":"vendor","nicknames":[],"who_cares":["ibm-mq","messaging","queue-consumers"],"confidence":0.6,"needs_auth":"yes","worst_case":"Consuming applications crash, causing denial of service","analyst_note":"Confirm fixed version and affected consumer types from the IBM security bulletin for CVE-2026-14511; the NVD entry only gives the summary.","how_to_check":"- Run `dspmqver` on the queue manager host and compare the reported version against `9.4.5.0` and `9.4.5.1`\n- unknown for other checks: the sources do not say which configurations expose the consuming applications","needs_analyst":true,"not_affected_if":["other-mq-versions"],"who_is_affected":"Teams running IBM MQ 9.4.5.0 through 9.4.5.1 where authenticated users can send messages to queues read by applications. The sources do not describe the exact message path or which consumer types crash. Systems on other MQ versions are not listed as affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000619,"input_tokens":3343,"output_tokens":569,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-14511':13A,16A '-2026':12A,15A '9.4.5.0':32B,63C '9.4.5.1':34B,65C 'affect':50B 'allow':67C 'applic':10A,51B,86C 'authent':6A,46B,69C 'caus':56B,72C 'consum':9A,27B,53B,85C 'could':66C 'craft':3A,41B,81C 'crash':8A,37B,49B,84C 'cve':11A,14A 'denial':58B,74C 'ibm':1A,17A,19A,22B,29B,61C 'ibm-mq':21B 'messag':4A,24B,42B,55B,82C 'mq':2A,18A,20A,23B,30B,62C 'queue':26B 'queue-consum':25B 'send':78C 'sent':43B 'servic':60B,76C 'special':40B,80C 'user':7A,47B,70C 'vendor':28B 'version':31B","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM MQ 9.4.5.0 through 9.4.5.1 where authenticated users can send messages to queues read by applications. The sources do not describe the exact message path or which consumer types crash. Systems on other MQ versions are not listed as affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T17:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-14511","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14511","severity":null,"published_at":"2026-10-19T17:17:20+00:00","modified_at":"2026-10-23T17:07:14+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}