CVE Alert: CVE-2025-36128 – IBM – MQ

Risk verdict

High risk of remote denial of service if the MQ instance is reachable; patching and exposure assessment should be prioritised, especially where network-facing endpoints exist.

Why this matters

An unauthenticated remote attacker can trigger slowloris-style read timeouts to exhaust MQ resources, potentially halting message processing and disrupting business workflows. In environments where MQ underpins critical integrations or message flows, a DoS could cascade into application downtime and service-level impact.

Most likely attack path

Exploitation is network-based with no privileges or user interaction required, and low complexity. An attacker sends crafted, slow requests to the MQ listener, tying up reads and worker threads, leading to resource exhaustion while the scope remains unchanged; pattern fits high-volume, stealthy connectivity from the internet or poorly segmented networks.

Who is most exposed

Organizations running IBM MQ 9.1–9.4 in production, especially where MQ endpoints are exposed directly to untrusted networks or poorly protected DMZs, are at greatest risk. CD and LTS deployments alike may be affected if not properly shielded.

Detection ideas

• Spike in half-open/long-lived connections and elevated connection timeout messages.
• Unusual CPU/memory usage on MQ nodes without corresponding business activity.
• Logs showing repeated read-timeouts or backlog growth.
• Proxy/WAF logs noting slowloris-like patterns targeting MQ endpoints.
• Anomalous traffic from a small set of IPs or geographies.

Mitigation and prioritisation

• Patch to latest supported version for affected lines; follow IBM advisory guidance.
• Implement load balancer request buffering and strict timeouts; enable reverse proxy/WAF with rate limiting.
• Enforce concurrent-connection limits and IP-based throttling; isolate MQ behind network segmentation.
• Validate change management in non-production before rollout; schedule a maintenance window if required.
• If KEV is present or EPSS ≥ 0.5, treat as priority 1. (No explicit KEV/EPSS flag shown here.)