CVE-2025-36128

📊 7.5 HIGH⚡ 0.1%🎯 0 exploits

📅 Published Oct 16, 2025

📋 Status: Analyzed

IBM MQ 9.1, 9.2, 9.3, 9.4 LTS and 9.3, 9.4 CD is vulnerable to a denial of service, caused by improper enforcement of the timeout on individual read operations. By conducting slowloris-type attacks, a remote attacker could exploit this vulnerability to cause a denial of service.

CVSS v3.1 • [email protected]

🎯 Affected Products & Systems

11 product configurations affected

Filter by type:

Type	Vendor	Product	Version Range	Status	CPE String
📱App	ibm	mq	9.1.0.0	Vulnerable	cpe:2.3:a:ibm:mq:9.1.0.0::::lts:::
📱App	ibm	mq	9.2.0.0	Vulnerable	cpe:2.3:a:ibm:mq:9.2.0.0::::lts:::
📱App	ibm	mq	9.3.0	Vulnerable	cpe:2.3:a:ibm:mq:9.3.0::::continuous_delivery:::
📱App	ibm	mq	9.3.0.0	Vulnerable	cpe:2.3:a:ibm:mq:9.3.0.0::::lts:::
📱App	ibm	mq	9.4.0	Vulnerable	cpe:2.3:a:ibm:mq:9.4.0::::continuous_delivery:::
📱App	ibm	mq	9.4.0.0	Vulnerable	cpe:2.3:a:ibm:mq:9.4.0.0::::lts:::
💻OS	ibm	aix	All versions	Not Vulnerable	cpe:2.3:o:ibm:aix:-:::::::*
💻OS	ibm	i	All versions	Not Vulnerable	cpe:2.3:o:ibm:i:-:::::::*
💻OS	linux	linux kernel	All versions	Not Vulnerable	cpe:2.3:o:linux:linux_kernel:-:::::::*
💻OS	microsoft	windows	All versions	Not Vulnerable	cpe:2.3:o:microsoft:windows:-:::::::*
💻OS	oracle	solaris	All versions	Not Vulnerable	cpe:2.3:o:oracle:solaris:-:::::::*

📱

ibm / mq

Application

Vulnerable

Version: 9.1.0.0

CPE:

cpe:2.3:a:ibm:mq:9.1.0.0:*:*:*:lts:*:*:*

📱

ibm / mq

Application

Vulnerable

Version: 9.2.0.0

CPE:

cpe:2.3:a:ibm:mq:9.2.0.0:*:*:*:lts:*:*:*

📱

ibm / mq

Application

Vulnerable

Version: 9.3.0

CPE:

cpe:2.3:a:ibm:mq:9.3.0:*:*:*:continuous_delivery:*:*:*

📱

ibm / mq

Application

Vulnerable

Version: 9.3.0.0

CPE:

cpe:2.3:a:ibm:mq:9.3.0.0:*:*:*:lts:*:*:*

📱

ibm / mq

Application

Vulnerable

Version: 9.4.0

CPE:

cpe:2.3:a:ibm:mq:9.4.0:*:*:*:continuous_delivery:*:*:*

📱

ibm / mq

Application

Vulnerable

Version: 9.4.0.0

CPE:

cpe:2.3:a:ibm:mq:9.4.0.0:*:*:*:lts:*:*:*

💻

ibm / aix

Operating System

Safe

Version: All versions

CPE:

cpe:2.3:o:ibm:aix:-:*:*:*:*:*:*:*

💻

ibm / i

Operating System

Safe

Version: All versions

CPE:

cpe:2.3:o:ibm:i:-:*:*:*:*:*:*:*

💻

linux / linux kernel

Operating System

Safe

Version: All versions

CPE:

cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

💻

microsoft / windows

Operating System

Safe

Version: All versions

CPE:

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

💻

oracle / solaris

Operating System

Safe

Version: All versions

CPE:

cpe:2.3:o:oracle:solaris:-:*:*:*:*:*:*:*

11 products•scroll for more

Metrics

7.5 HIGHCVSS v3.1[email protected]

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector:

NETWORK

Complexity:

LOW

Privileges:

NONE

User Interaction:

NONE

Confidentiality:

NONE

Integrity:

NONE

Availability:

HIGH

Scope:

UNCHANGED

🔍 Technical Details

Analysis Status

Analyzed

CVSS Details

7.5 (HIGH)v3.1

Source: [email protected]

EPSS Details

0.1% (Minimal)32.6th percentile

Last updated: Oct 30, 2025

Exploitation probability within 30 days

Published Date

Oct 16, 2025 (16 days ago)

Last Modified

Oct 28, 2025 (4 days ago)

Security Weaknesses1

CWE-772

References2

NVDgeneral