{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-19645", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2026-08-12T17:12:34.967Z", "datePublished": "2026-09-04T15:20:24.432Z", "dateUpdated": "2026-09-04T15:20:24.432Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-09-04T15:20:24.432Z"}, "title": "Multiple vulnerabilities in IBM MQ Agent images", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "MQ Agent", "versions": [{"status": "affected", "version": "CD: v1.0.0, v1.0.1, v2.0.0, v2.0.1"}], "cpes": ["cpe:2.3:a:ibm:mq_agent:cd:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM MQ Agent CD: v1.0.0, v1.0.1, v2.0.0, v2.0.1 An authenticated user with a valid session cookie can submit arbitrarily large or computationallyexpensive requests that cause the LLM agent workers to be held for extended periods \u2014 rangingfrom tens of seconds to over ten minutes per request. When multiple such requests are sentconcurrently, the agent worker pool becomes exhausted, causing all other IBM MQ Console users toexperience degraded performance or complete unavailability of the AI Agent feature.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM MQ Agent CD: v1.0.0, v1.0.1, v2.0.0, v2.0.1 An authenticated user with a valid session cookie can submit arbitrarily large or computationallyexpensive requests that cause the LLM agent workers to be held for extended periods \u2014 rangingfrom tens of seconds to over ten minutes per request. When multiple such requests are sentconcurrently, the agent worker pool becomes exhausted, causing all other IBM MQ Console users toexperience degraded performance or complete unavailability of the AI Agent feature.</p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7285394", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseSeverity": "MEDIUM", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}}], "solutions": [{"lang": "en", "value": "Issues mentioned by this security bulletin are addressed in IBM MQ Agent v2.0.2 image.\n\n\n\nIBM strongly recommends applying the latest agent images.\n\n\n\nIBM MQ Agent v2.0.2 release details:\n\n\n\nImage\n\n\n\nFix Version\n\n\n\nRegistry\n\n\n\nImage Location\n\n\n\nibm-mq-agent-runtime\n\n\n\nv2.0.2\n\n\n\ncp.icr.io\n\ncp.icr.io/cp/ibm-mq-agent-runtime:v2.0.2@sha256:564a3ea85fb601b6bcad4edfd1fe681430d3302338566eb9a554b76e88dc5381\n\nibm-mq-agent-mcp\n\n\n\nv2.0.2\n\n\n\ncp.icr.io\n\n\n\ncp.icr.io/cp/ibm-mq-agent-mcp:v2.0.2@sha256:400e94ea5312a1307a03e4098506d2e30f7638a0c1410992ce50c59f5cf7a25e\n\n\n\nibm-mq-agent-embedding-service\n\n\n\nv2.0.2\n\n\n\ncp.icr.io\n\n\n\ncp.icr.io/cp/ibm-mq-agent-embedding-service:v2.0.2@sha256:1c324e024462984462a0c7286b7249f76ee1f3bd08000cddf6e431766eea5d7a", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Issues mentioned by this security bulletin are addressed in IBM MQ Agent v2.0.2 image.</p><p>IBM strongly recommends applying the latest agent images.</p><p>IBM MQ Agent v2.0.2 release details:</p><div><div><div><div><table><tbody><tr><td><p>Image</p></td><td><p>Fix Version</p></td><td><p>Registry</p></td><td><p>Image Location</p></td></tr><tr><td><p>ibm-mq-agent-runtime</p></td><td><p>v2.0.2</p></td><td><p>cp.icr.io</p></td><td>cp.icr.io/cp/ibm-mq-agent-runtime:v2.0.2@sha256:564a3ea85fb601b6bcad4edfd1fe681430d3302338566eb9a554b76e88dc5381</td></tr><tr><td><p>ibm-mq-agent-mcp</p></td><td><p>v2.0.2</p></td><td><p>cp.icr.io</p></td><td><p>cp.icr.io/cp/ibm-mq-agent-mcp:v2.0.2@sha256:400e94ea5312a1307a03e4098506d2e30f7638a0c1410992ce50c59f5cf7a25e</p></td></tr><tr><td><p>ibm-mq-agent-embedding-service</p></td><td><p>v2.0.2</p></td><td><p>cp.icr.io</p></td><td><p>cp.icr.io/cp/ibm-mq-agent-embedding-service:v2.0.2@sha256:1c324e024462984462a0c7286b7249f76ee1f3bd08000cddf6e431766eea5d7a</p></td></tr></tbody></table></div></div></div></div>"}]}]}}}

{}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ibm:mq_agent:cd:*:*:*:*:*:*:*"], "product": "MQ Agent", "vendor": "IBM", "versions": [{"status": "affected", "version": "CD: v1.0.0, v1.0.1, v2.0.0, v2.0.1"}]}], "source": "psirt@us.ibm.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM MQ Agent CD: v1.0.0, v1.0.1, v2.0.0, v2.0.1 An authenticated user with a valid session cookie can submit arbitrarily large or computationallyexpensive requests that cause the LLM agent workers to be held for extended periods \u2014 rangingfrom tens of seconds to over ten minutes per request. When multiple such requests are sentconcurrently, the agent worker pool becomes exhausted, causing all other IBM MQ Console users toexperience degraded performance or complete unavailability of the AI Agent feature."}], "id": "CVE-2026-19645", "lastModified": "2026-09-08T14:17:08.940", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "psirt@us.ibm.com", "type": "Primary"}]}, "published": "2026-09-04T16:17:24.923", "references": [{"source": "psirt@us.ibm.com", "url": "https://www.ibm.com/support/pages/node/7285394"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "psirt@us.ibm.com", "type": "Primary"}]}

{}