Security Bulletin: IBM MQ is affected by a denial of service vulnerability (CVE-2026-12350)

Summary IBM MQ has addressed a denial of service vulnerability caused by sending a specially crafted asynchronous consume request that crashes the queue manager agent process. Vulnerability Details CVEID:CVE-2026-12350 DESCRIPTION: IBM MQ could allow an authenticated attacker to cause a denial of...

amont-agent (>=2.25.0, <=3.13.1), amont-agent-process (>=2.45.0, <=3.13.1) +18 more potentially affected by unknown CVE via pulldown-cmark (>=0.13.0, <=0.13.5)

pulldown-cmark CARGO version =0.13.0, =2.25.0, =2.45.0, =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.2.3, =0.5.0, =0.5.5, =0.10.0, =0.5.5, =0.3.2, =0.1.0, =0.0.1, =0.0.5 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0433...

Jenkins security vulnerabilities

Security vulnerabilities exist in Jenkins versions 2.587 and earlier, as well as 2.580.1 and earlier. These vulnerabilities arise from the fact that the agent calculates URLs for links displayed in the workspace browser for each file and directory; this may allow attackers controlling the agent...

CVE-2026-12350

IBM MQ could allow an authenticated attacker to cause a denial of service by sending a specially crafted asynchronous consume request that crashes the queue manager agent process...

EUVD-2026-104467

IBM MQ could allow an authenticated attacker to cause a denial of service by sending a specially crafted asynchronous consume request that crashes the queue manager agent process...

CVE-2026-12350: Deserialization of Untrusted Data

IBM MQ could allow an authenticated attacker to cause a denial of service by sending a specially crafted asynchronous consume request that crashes the queue manager agent process...

PT-2026-117510

IBM MQ could allow an authenticated attacker to cause a denial of service by sending a specially crafted asynchronous consume request that crashes the queue manager agent process...

amont-agent (>=2.25.0, <=3.6.0), amont-agent-process (>=2.45.0, <=3.6.0) +13 more potentially affected by unknown CVE via pulldown-cmark (>=0.13.0, <=0.13.4)

pulldown-cmark CARGO version =0.13.0, =2.25.0, =2.45.0, =0.1.1, =0.1.0, =0.5.0, =0.5.5, =0.10.0, =0.0.1, =2.0.0, =2.0.0, =0.27.0, =2.3.0-alpha.1, =2.3.0-alpha.1, =2.3.0-alpha.4 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0414...

CVE-2026-85201

In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length-delimited protobuf message received through the Control Interface FIFO. A workload granted Control Interface access can specify an excessive message length, causing an unbounded...

CVE-2026-85201

In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length-delimited protobuf message received through the Control Interface FIFO. A workload granted Control Interface access can specify an excessive message length, causing an unbounded...

CVE-2026-84648

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata source, level, and timestamp resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers in control of agent processes...

EUVD-2026-70114

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata source, level, and timestamp resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers in control of agent processes...

CVE-2026-84648

Jenkins versions 2.579 and earlier , and LTS 2.568.2 and earlier , are vulnerable to a stored cross-site scripting (XSS) vulnerability. The root cause is that the system log viewer fails to escape log record metadata, specifically the source, level, and timestamp . This flaw is exploitable by att...

PT-2026-84771

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata source, level, and timestamp resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers in control of agent processes...

PT-2026-73343

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary...

CVE-2026-70427

A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction...

CVE-2026-70427

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary...

CVE-2026-70427

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary...

CVE-2026-70427

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary...

PT-2026-68262

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.576 Jenkins LTS versions prior to 2.568.2 Description Jenkins fails to safely handle symbolic links with effectively empty names when extracting .tar and .tar.gz archives. This allows attackers who control agent...