CVE-2024-51470: IBM MQ denial of service

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-12-18 · updated 2026-06-17
Weakness: CWE-754

Description

IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD, IBM MQ Appliance 9.3 LTS, 9.3 CD, 9.4 LTS, and IBM MQ for HPE NonStop 8.1.0 through 8.1.0.25 could allow an authenticated user to cause a denial-of-service due to messages with improperly set values.

Affected products

IBM MQ Appliance: from 9.1.0.0 before 9.1.0.26; from 9.2.0.0 before 9.2.0.30; from 9.3.0.0 before 9.3.0.26; from 9.4.0.0 before 9.4.0.7 — fixed in 9.1.0.26, 9.2.0.30, 9.3.0.26, 9.4.0.7
IBM MQ for HPE NonStop: from 8.1.0 before 8.1.0.26 — fixed in 8.1.0.26

How to fix

Upgrade to a fixed version: IBM MQ Appliance 9.1.0.26, 9.2.0.30, 9.3.0.26, 9.4.0.7; IBM MQ for HPE NonStop 8.1.0.26. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-51470 or the next vulnerability affects your stack