{"id":"CVE-2026-10858","aliases":["EUVD-2026-83034","GHSA-cmx7-5fpv-xc6x"],"status":"published","title":"IBM MQ for HPE NonStop is vulnerable to a denial of service attack","description":"IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer underflow when processing multi-segment messages.","severity":{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0059,"percentile":0.48569,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-122"],"published":"2026-09-18T16:08:37Z","modified":"2026-09-19T04:17:51Z","products":[{"vendor":"ibm","product":"mq for hpe nonstop"}],"references":[{"url":"https://www.ibm.com/support/pages/node/7287704","tags":["vendor-advisory","patch"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10858"},{"url":"https://github.com/advisories/GHSA-cmx7-5fpv-xc6x"}],"sources":{"cve":[{"id":"CVE-2026-10858","title":"IBM MQ for HPE NonStop is vulnerable to a denial of service attack","description":"IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer underflow when processing multi-segment messages.","status":"published","published":"2026-09-18T16:08:37.78Z","modified":"2026-09-19T03:56:50.473Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T13:40:01.309549Z"}],"euvd":[{"id":"EUVD-2026-83034","description":"IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer underflow when processing multi-segment messages.","status":"published","published":"2026-09-18T16:08:37Z","modified":"2026-09-19T03:56:50Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T17:28:06.992666Z"}],"ghsa":[{"id":"GHSA-cmx7-5fpv-xc6x","title":"IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a...","description":"IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer underflow when processing multi-segment messages.","status":"published","published":"2026-09-18T18:31:40Z","modified":"2026-09-18T18:31:53Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:12:11.358904Z"}],"nvd":[{"id":"CVE-2026-10858","description":"IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer underflow when processing multi-segment messages.","status":"published","published":"2026-09-18T16:17:05.31Z","modified":"2026-09-19T04:17:51.203Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:12:49.70655Z"}]}}