CVE-2023-47745

CVE-2023-47745 affects IBM MQ Operator and related IBM MQ deployments. Affected: IBM MQ Operator versions and associated IBM MQ container images (Operator 21.0.x/23.0.x ranges; 2.2.x–2.4.x family; Cloud Pak variants) store or transmit user credentials in plain text, readable by a local user via t...

CVE-2024-27255

CVE-2024-27255 affects IBM MQ Operator and related container images, where a cryptographic weakness in the operator’s crypto algorithms could allow decryption of highly sensitive information. Affected versions include IBM MQ Operator v2.0.0–2.0.18, v2.2.0–2.2.2, v2.3.0–2.3.3, v2.4.0–2.4.7, and v3...

CVE-2024-27256

CVE-2024-27256 affects IBM MQ Container images: CD v3.0.0, v3.0.1, v3.1.0–3.1.3; LTS v2.0.0–2.0.22; and 2.4.0–2.4.8, 2.3.0–2.3.3, 2.2.0–2.2.2. Description: use of weaker than expected cryptographic algorithms could allow an attacker to decrypt highly sensitive information. Connected sources corro...

CVE-2025-27365

CVE-2025-27365 affects IBM MQ Operator LTS 2.0.0–2.0.29, MQ Operator CD 3.0.0–3.1.3, 3.3.0–3.5.1, and MQ Operator SC2 3.2.0–3.2.10. Description: a client connecting to an IBM MQ Queue Manager may trigger a SIGSEGV in the AMQRMPPA channel process, terminating it. CVSS v3.1 base score reported as 6...

CVE-2024-40680

CVE-2024-40680 affects IBM MQ 9.3 CD and 9.4 LTS/CD. The vulnerability allows a local user to cause a denial of service via improper memory allocation leading to a segmentation fault. The IBM advisories state remediation via APAR IT45634: for IBM MQ 9.3 CD, upgrade to 9.4 and apply Fix Pack 9.4.0...

CVE-2024-40681

CVE-2024-40681 affects IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD. An authenticated user in a specifically defined role could bypass security restrictions and execute actions against the queue manager. The issue is a security bypass in IBM MQ/Operator context; remediation requi...

CVE-2024-39743

CVE-2024-39743 affects IBM MQ Operator and IBM MQ Container Developer Edition. The issue is a denial of service caused by incorrect memory de-allocation, enabling a remote attacker to drive memory resource consumption. Publicly documented impact includes memory exhaustion risk on affected contain...

CVE-2025-1333

CVE-2025-1333 affects IBM MQ Container when used with the IBM MQ Operator (LTS 2.0.0–2.0.29; CD 3.0.0–3.1.3, 3.3.0–3.4.1, 3.5.0–3.5.1; SC2 3.2.0–3.2.10) and configured with Cloud Pak for Integration Keycloak, enabling disclosure of sensitive information to a privileged user. Red Hat and IBM sourc...

CVE-2024-39742

CVE-2024-39742 affects IBM MQ Operator by allowing authentication bypass in certain configurations due to a partial string comparison. Affected: IBM MQ Operator versions SC2 (LTS) v3.2.0/v3.2.1 and CD v3.0.0–3.1.3; LTS v2.0.0–2.0.23; and IBM supplied MQ Advanced container images. Connected source...

CVE-2025-36041

CVE-2025-36041 affects IBM MQ Operator and related containers. A misconfiguration in Native HA CRR could allow a private key/chain other than the intended key to be used, risking disclosure of sensitive information or unauthorized actions. Affected: IBM MQ Operator LTS 2.0.0–2.0.29; CD 3.0.0, 3.0...

CVE-2025-33013

CVE-2025-33013 affects IBM MQ Operator and related container images. The issue is information disclosure caused by improper clearing of heap memory before release, exploitable by a local user. Affected versions include IBM MQ Operator LTS 2.0.0–2.0.29, MQ Operator CD 3.0.0–3.0.1, 3.1.0–3.1.3, 3.3...

CVE-2025-36005

CVE-2025-36005 affects IBM MQ Operator families (LTS 2.0.x, CD 3.x, SC2 3.2.x) and IBM MQ Container images. Root cause: improper certificate validation enabling an Internet Pass-Thru proxy to access data from another TLS session when connecting to the same hostname/port. Impact: potential informa...