CVE-2025-36128
📋 TL;DR
IBM MQ is vulnerable to denial of service attacks where attackers can exploit improper timeout enforcement on read operations to exhaust server resources. This affects IBM MQ versions 9.1 through 9.4 LTS and 9.3 through 9.4 CD deployments. Attackers can use slowloris-type attacks to keep connections open and degrade or crash MQ services.
💻 Affected Systems
- IBM MQ
📦 What is this software?
Mq by Ibm
Mq by Ibm
Mq by Ibm
Mq by Ibm
Mq by Ibm
Mq by Ibm
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage of IBM MQ, disrupting message queuing for dependent applications and causing business process failures.
Likely Case
Degraded performance and intermittent service disruptions as connections are exhausted, impacting message throughput and reliability.
If Mitigated
Minimal impact with proper network segmentation, rate limiting, and monitoring in place to detect and block attack patterns.
🎯 Exploit Status
Slowloris attacks are well-known and easy to implement with readily available tools.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply fixes per IBM advisory: 9.1 LTS (9.1.0.15), 9.2 LTS (9.2.0.13), 9.3 LTS (9.3.0.11), 9.4 LTS (9.4.0.4), 9.3 CD (9.3.0.11), 9.4 CD (9.4.0.4)
Vendor Advisory: https://www.ibm.com/support/pages/node/7244480
Restart Required: Yes
Instructions:
1. Review IBM advisory. 2. Download appropriate fix pack from IBM Fix Central. 3. Apply fix following IBM installation procedures. 4. Restart IBM MQ services.
🔧 Temporary Workarounds
Network-level rate limiting
allImplement connection rate limiting and timeout enforcement at network perimeter devices.
Web Application Firewall rules
allConfigure WAF to detect and block slowloris attack patterns.
🧯 If You Can't Patch
- Implement strict network segmentation to limit exposure to trusted sources only.
- Deploy intrusion prevention systems with slowloris detection capabilities.
🔍 How to Verify
Check if Vulnerable:
Check IBM MQ version using 'dspmqver' command and compare against affected versions.Check Version:
dspmqverVerify Fix Applied:
Verify version after patching with 'dspmqver' and ensure it matches fixed versions listed in advisory.📡 Detection & Monitoring
Log Indicators:
- Unusually high number of open connections
- Connection timeout errors
- Increased AMQERR*.LOG entries
Network Indicators:
- Multiple slow HTTP/HTTPS connections from single source
- Incomplete HTTP requests with long delays
SIEM Query:
source="ibm_mq" AND (error="timeout" OR connections>threshold)