PatchTheCEVCVE-2026-14511: IBM MQ 9.4.5.0 through 9.4.5.1 could allow an authenticated user to cause a denial of service by sending a spe
31
Routine
MEDIUM 6.5DOWNGRADE
CVE-2026-14511 is a medium-severity flaw (CVSS 6.5) affecting mq. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
IBM MQ 9.4.5.0 through 9.4.5.1 could allow an authenticated user to cause a denial of service by sending a specially crafted message that crashes consuming applications.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.5 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 66%) |
| CISA exploited list | No |
| Weakness | CWE-770 |
| Published | 2026-10-19 |
| Last modified | 2026-10-23 |
Publisher (CNA): IBM Corporation · Vendor: ibm
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
ibm mq DOWNGRADE
Affected: 9.4.5.0 · 9.4.5.1
Fixed in: no fixed release known
Safe to downgrade to: a release before 9.4.5.0
1. Check installed version
apt-cache policy mq || rpm -q mq || mq --version
2. No fixed release: DOWNGRADE to a release before 9.4.5.0 (Debian / Ubuntu)
apt-cache madison mq
sudo apt install mq=<VERSION_BEFORE_9.4.5.0>
sudo apt-mark hold mq
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list mq
sudo dnf downgrade mq-<VERSION_BEFORE_9.4.5.0>
sudo dnf versionlock add mq
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Exact fixes by distribution
A distro patch exists: prefer upgrading over downgrading.
Fedora 46 · gum · FIXED · 2.0.2-1.fc46 · FEDORA-2026-da0d6dd894 · source
sudo dnf upgrade --advisory=FEDORA-2026-da0d6dd894
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.