This vulnerability (CWE-611) exists in IBM MQ versions 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 in the Java classes handling MQRFH2 headers. It allows an authenticated attacker to perform XML external entity injection, potentially leading to disclosure of sensitive information or denial of service conditions. The CVSS v3.1 base score is 8.1, indicating high severity with network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality and availability.

Successful exploitation can lead to unauthorized disclosure of sensitive information or cause denial of service in affected IBM MQ installations. The attacker must be authenticated, but no user interaction is required. The vulnerability affects confidentiality and availability but not integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the current data. Until a patch is available, restrict authenticated user privileges to limit exposure and monitor for suspicious activity related to MQRFH2 header processing.