CVE-2025-36128

IBM MQ 9.1, 9.2, 9.3, 9.4 LTS and 9.3, 9.4 CD is vulnerable to a denial of service, caused by improper enforcement of the timeout on individual read operations. By conducting slowloris-type attacks, a remote attacker could exploit this vulnerability to cause a denial of service.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.ibm.com/support/pages/node/7244480	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:ibm:mq:9.1.0.0::::lts:::
	cpe:2.3:a:ibm:mq:9.2.0.0::::lts:::
	cpe:2.3:a:ibm:mq:9.3.0::::continuous_delivery:::
	cpe:2.3:a:ibm:mq:9.3.0.0::::lts:::
	cpe:2.3:a:ibm:mq:9.4.0::::continuous_delivery:::
	cpe:2.3:a:ibm:mq:9.4.0.0::::lts:::

OR	cpe:2.3:o:ibm:aix:-:::::::*
	cpe:2.3:o:ibm:i:-:::::::*
	cpe:2.3:o:linux:linux_kernel:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*
	cpe:2.3:o:oracle:solaris:-:::::::*

History

09 Oct 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) IBM MQ 9.1, 9.2, 9.3, 9.4 LTS y 9.3, 9.4 CD es vulnerable a una denegación de servicio, causada por una aplicación incorrecta del tiempo de espera (timeout) en operaciones de lectura individuales. Al realizar ataques de tipo slowloris, un atacante remoto podría explotar esta vulnerabilidad para causar una denegación de servicio.

Information

Published : 2025-10-16 17:15

Updated : 2026-10-09 10:10

NVD link : CVE-2025-36128

Mitre link : CVE-2025-36128

CVE.ORG link : CVE-2025-36128

JSON object : View

Products Affected

oracle

solaris

ibm

mq
i
aix

linux

linux_kernel

microsoft

windows

CWE

CWE-772

Missing Release of Resource after Effective Lifetime

{"id": "CVE-2025-36128", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-36128", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-16T18:03:23.348860Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@us.ibm.com", "affectedData": [{"cpes": ["cpe:2.3:a:ibm:mq:9.1.0:*:*:*:lts:*:*:*", "cpe:2.3:a:ibm:mq:9.2.0:*:*:*:lts:*:*:*", "cpe:2.3:a:ibm:mq:9.3.0:*:*:*:lts:*:*:*", "cpe:2.3:a:ibm:mq:9.4.0:*:*:*:lts:*:*:*"], "vendor": "IBM", "product": "MQ", "versions": [{"status": "affected", "version": "9.1"}, {"status": "affected", "version": "9.2"}, {"status": "affected", "version": "9.3"}, {"status": "affected", "version": "9.4"}], "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:a:ibm:mq:9.3.0:*:*:*:continuous_delivery:*:*:*", "cpe:2.3:a:ibm:mq:9.4.0:*:*:*:continuous_delivery:*:*:*"], "vendor": "IBM", "product": "MQ", "versions": [{"status": "affected", "version": "9.3"}, {"status": "affected", "version": "9.4"}], "defaultStatus": "unaffected"}]}], "published": "2025-10-16T17:15:33.547", "references": [{"url": "https://www.ibm.com/support/pages/node/7244480", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-772"}]}], "descriptions": [{"lang": "en", "value": "IBM MQ 9.1, 9.2, 9.3, 9.4 LTS and 9.3, 9.4 CD is vulnerable to a denial of service, caused by improper enforcement of the timeout on individual read operations. By conducting slowloris-type attacks, a remote attacker could exploit this vulnerability to cause a denial of service."}, {"lang": "es", "value": "IBM MQ 9.1, 9.2, 9.3, 9.4 LTS y 9.3, 9.4 CD es vulnerable a una denegaci\u00f3n de servicio, causada por una aplicaci\u00f3n incorrecta del tiempo de espera (timeout) en operaciones de lectura individuales. Al realizar ataques de tipo slowloris, un atacante remoto podr\u00eda explotar esta vulnerabilidad para causar una denegaci\u00f3n de servicio."}], "lastModified": "2026-10-09T10:10:00.193", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:mq:9.1.0.0:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "2E9E3A1B-D35D-4029-835C-C27917C2ABD7"}, {"criteria": "cpe:2.3:a:ibm:mq:9.2.0.0:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "AF700EBE-9E12-40AD-85B6-2B4C53514EC1"}, {"criteria": "cpe:2.3:a:ibm:mq:9.3.0:*:*:*:continuous_delivery:*:*:*", "vulnerable": true, "matchCriteriaId": "89BDCCFD-C1DF-4E19-8597-DF87C56D7E09"}, {"criteria": "cpe:2.3:a:ibm:mq:9.3.0.0:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "574B92D2-A5C4-485F-AD8C-D82DC62CE5D1"}, {"criteria": "cpe:2.3:a:ibm:mq:9.4.0:*:*:*:continuous_delivery:*:*:*", "vulnerable": true, "matchCriteriaId": "FE929BED-85A5-42DB-AAA4-B3EB90A1231D"}, {"criteria": "cpe:2.3:a:ibm:mq:9.4.0.0:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "060C8A17-3897-4A14-AECF-2222313FC61B"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:ibm:aix:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E492C463-D76E-49B7-A4D4-3B499E422D89"}, {"criteria": "cpe:2.3:o:ibm:i:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "C684FC45-C9BA-4EF0-BD06-BB289450DD21"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}, {"criteria": "cpe:2.3:o:oracle:solaris:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "91F372EA-3A78-4703-A457-751B2C98D796"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@us.ibm.com"}