Description

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-14T21:17:01.823Z",
  "pubdate": "2026-09-14T21:17:01.823Z",
  "executiveSummary": "IBM MQ is susceptible to an XML External Entity (XXE) injection vulnerability arising from improper processing of XML data. This vulnerability allows remote, unauthenticated attackers to manipulate XML parsers to include unauthorized external entities. The primary risk implications include the unauthorized disclosure of sensitive internal data, such as local configuration files or system credentials, and potential denial-of-service (DoS) conditions through excessive resource consumption. Impacted product versions span multiple LTS and CD releases, specifically IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0. Successful exploitation requires the application to process maliciously crafted XML input. Organizations are at risk of data breaches and service instability if the XML parser is not configured to disable DTD processing and external entity resolution.",
  "technicalDetails": "The vulnerability originates from the application's XML parsing mechanism, which fails to restrict the resolution of external entities defined within a Document Type Definition (DTD). When the XML parser is configured without strict validation or security hardening, it will attempt to retrieve and parse content from external URIs or local file system paths specified in the XML payload.\nThe attack flow begins when a remote attacker submits a specially crafted XML document containing a malicious DTD to an endpoint within IBM MQ that processes XML input. The DTD includes an ENTITY declaration that points to a sensitive file on the target server (e.g., file:///etc/passwd) or an external network resource. Upon processing, the XML parser expands this entity, effectively instructing the application to read the target resource and incorporate its content into the application's memory or process output.\nThe vulnerability facilitates two primary attack vectors: Information Disclosure and Resource Exhaustion. In the context of information disclosure, the attacker can force the application to return the contents of local files, potentially exposing application secrets, environment variables, or configuration data. In the context of resource exhaustion, attackers may use XML bomb payloads (such as recursive entity expansion) to force the parser to consume excessive CPU or memory, leading to service unavailability. The vulnerability is typically accessible over the network without the requirement for prior authentication or elevated privileges, depending on the specific exposed interface utilizing the vulnerable parser.\nThe affected components are the XML processing libraries utilized by IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0. Post-exploitation, the attacker gains the ability to exfiltrate sensitive files or degrade system performance. The root cause is the lack of proper defensive configuration regarding XML input validation, specifically the failure to disable DTD-based external entity resolution during the parsing process."
}