IBM MQ/MQ Appliance/MQ for HPE NonStop Message unusual condition

Summaryinfo

A vulnerability identified as critical has been detected in IBM MQ, MQ Appliance and MQ for HPE NonStop. Affected by this vulnerability is an unknown functionality of the component Message Handler. This manipulation causes unusual condition. This vulnerability is handled as CVE-2024-51470. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in IBM MQ, MQ Appliance and MQ for HPE NonStop (affected version not known). It has been declared as critical. Affected by this vulnerability is some unknown functionality of the component Message Handler. The manipulation with an unknown input leads to a unusual condition vulnerability. The CWE definition for the vulnerability is CWE-754. The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product. As an impact it is known to affect availability. The summary by CVE is:

IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD, IBM MQ Appliance 9.3 LTS, 9.3 CD, 9.4 LTS, and IBM MQ for HPE NonStop 8.1.0 through 8.1.0.25 could allow an authenticated user to cause a denial-of-service due to messages with improperly set values.

It is possible to read the advisory at ibm.com. This vulnerability is known as CVE-2024-51470 since 10/28/2024. The exploitation appears to be easy. The attack can be launched remotely. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/16/2025).

The vulnerability scanner Nessus provides a plugin with the ID 240635 (IBM MQ DoS (7179137)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (240635). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• IBM

Name

• MQ
• MQ Appliance
• MQ for HPE NonStop

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion