IBM has released critical security updates for its MQ Operator and queue manager container images, addressing multiple vulnerabilities that posed significant risks to system availability and data integrity. These updates are part of IBM’s ongoing commitment to proactively manage and reduce exposure to security threats in modern MQ environments.

Six distinct vulnerabilities have been identified and resolved, ranging in severity from medium to high. Among the most serious:

• CVE-2025-0395: A buffer overflow issue due to insufficient allocation for assertion failure messages in GNU C Library, with a CVSS score of 7.5.
• CVE-2025-22869: A denial-of-service vulnerability in SSH file transfer implementations, also rated 7.5, which could exhaust system memory.
• CVE-2024-45336: Mishandling of HTTP headers after cross-domain redirects, potentially leaking sensitive authentication information.

Other addressed issues include improper host matching in proxy configurations (CVE-2025-22870), information leaks in ppc64le architectures (CVE-2025-22866), and URI validation gaps in certificate chains using private PKI (CVE-2024-45341).

The security fixes apply to a broad set of IBM MQ Operator and container image versions, including:

• IBM MQ Operator: Versions from 2.0.0 to 3.5.2 across SC2, CD, LTS, and other releases.
• IBM MQ Advanced Container Images: Ranging from 9.2.0.1 to 9.4.2.1 across multiple release tracks including LTS and CD.

Administrators using any of these versions should verify their deployments immediately.

IBM has published new secure container image versions that resolve all listed vulnerabilities:

• IBM MQ Operator v3.5.3 (CD Release) paired with MQ Advanced 9.4.2.1-r2
• IBM MQ Operator v3.2.12 (SC2 Release) paired with MQ Advanced 9.4.0.11-r2
• IBM MQ Container 9.4.2.1-r2 for standalone deployments

IBM recommends that all users update to these versions without delay to mitigate exposure.

In today’s hybrid and cloud-native environments, securing containerized middleware platforms is more critical than ever. MQ environments, which are central to many enterprise integration patterns, can become targets for attackers exploiting unpatched vulnerabilities. The latest patches ensure the integrity, availability, and confidentiality of your messaging infrastructure.

To learn more about how to secure your IBM MQ environments—especially in containerized and cloud-native deployments—download our complimentary whitepaper: Securing Modern MQ Environments

This paper provides a practical guide to hardening your middleware stack, identifying potential attack surfaces, and implementing best-in-class practices for MQ security in dynamic environments.