CVE-2025-36128: 
IBM WebSphere MQ vulnerability analysis and mitigation

CVE-2025-36128 is a vulnerability affecting IBM MQ versions 9.1, 9.2, 9.3, 9.4 LTS and 9.3, 9.4 CD. The vulnerability was discovered and disclosed on October 16, 2025, and involves a denial of service condition caused by improper enforcement of timeout on individual read operations (IBM Security Bulletin).

The vulnerability has been assigned a CVSS Base Score of 7.5 (HIGH) with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. It is categorized under CWE-772 (Missing Release of Resource after Effective Lifetime). The vulnerability specifically affects the REST API and Console components of IBM MQ (IBM Security Bulletin).

When exploited, this vulnerability can lead to a denial of service condition through Slowloris-type attacks. The attack can prevent the system from processing legitimate requests, effectively disrupting service availability (IBM Security Bulletin).

Several mitigation strategies have been recommended: 1) Configure load balancers to handle Slowloris DDoS attacks, 2) Implement reverse proxy solutions, 3) Deploy Web Application Firewalls (WAF), 4) Limit concurrent connections, and 5) Implement traffic rate limiting. These measures can be implemented through proper configuration of the IBM WebSphere Liberty profile (IBM Security Bulletin).