IBM MQ versions 9.4.5.0 and 9.4.5.1 are vulnerable to a denial‑of‑service attack that enables an authenticated user to send a specially crafted message which causes the consuming application to crash. The flaw is a resource exhaustion or fault condition (CWE‑770). When exploited, it does not leak data or grant elevation of privileges; it simply disrupts normal service operation by terminating applications that process the message.

The affected product is IBM MQ, specifically versions 9.4.5.0 and 9.4.5.1, which are part of the IBM MQ 9.4 release line. Updating to IBM MQ 10.0.0.0 resolves the issue. The known issue is DT500555 and can be confirmed by the product version identifiers used in the official advisories.

The CVSS score is 6.5, indicating moderate severity. No EPSS value is published, so the current likelihood of exploitation is unknown. The vulnerability is not listed in CISA’s KEV catalog. Attackers must be authenticated to the MQ server and locate a consumer that will process the malicious message; once sent, the consumer application will crash, resulting in service disruption.