You may have seen this:

www.ibm.com/support/pages/node/7240777
Security Bulletin: Informix HQ is vulnerable to HTML injection and does not lock out users after multiple incorrect password attempts
28 Jul 2025

The latest version 3.1.0 is described here:

www.ibm.com/docs/en/informix-servers/15.0.0?topic=guide-whats-new-in-informixhq
What's new in InformixHQ
22 Jul 2025

However, I can't find anywhere to download it. Have tried PA, Fix Central, MRS. Similar at HCL.

Meanwhile, IBM IDS 14.10.FC12 contains InformixHQ 3.0.4 which is not documented. It starts normally, but fails with "Invalid message type received from the sqlexec process" when trying to define an IDS server on the same host as HQ (Server Studio works fine). Also tried with 3.0.0 and 3.0.3 with the same result. 2.4.0 works fine.

Any ideas? Will raise with IBM if necessary.

------------------------------
Doug Lawry
Oninit Consulting
------------------------------

Hi Doug,

Try this:

https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EInformation%20Management&product=ibm/Information+Management/Informix&release=3.1.0&platform=All&function=all

In "IBM Support: Fix Central":

- Product selector: Informix Server

- Installed Version: 3.1.0

- Platform: All

Regards,

------------------------------
Boycho Velkov

Original Message:
Sent: Tue July 29, 2025 05:13 AM
From: Doug Lawry
Subject: InformixHQ 3

You may have seen this:

www.ibm.com/support/pages/node/7240777
Security Bulletin: Informix HQ is vulnerable to HTML injection and does not lock out users after multiple incorrect password attempts
28 Jul 2025

The latest version 3.1.0 is described here:

www.ibm.com/docs/en/informix-servers/15.0.0?topic=guide-whats-new-in-informixhq
What's new in InformixHQ
22 Jul 2025

However, I can't find anywhere to download it. Have tried PA, Fix Central, MRS. Similar at HCL.

Meanwhile, IBM IDS 14.10.FC12 contains InformixHQ 3.0.4 which is not documented. It starts normally, but fails with "Invalid message type received from the sqlexec process" when trying to define an IDS server on the same host as HQ (Server Studio works fine). Also tried with 3.0.0 and 3.0.3 with the same result. 2.4.0 works fine.

Any ideas? Will raise with IBM if necessary.

------------------------------
Doug Lawry
Oninit Consulting
------------------------------

Thanks, Boycho. My colleague also found it at Fix Central meanwhile. I could have sworn it wasn't there earlier, but maybe I was using it wrong! We found the easiest way is to specify 3.1.0 as the "Installed server version" which is probably what you did.

I have since tried that with IDS 14.10.FC12 and get the same problem. If InformixHQ 3 doesn't work with IDS 14, then there is no solution to the CVE (or access to new features) unless you are on 15.

Will raise with IBM unless someone responds here today.

Hi Doug,

Try this:

https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EInformation%20Management&product=ibm/Information+Management/Informix&release=3.1.0&platform=All&function=all

In "IBM Support: Fix Central":

- Product selector: Informix Server

- Installed Version: 3.1.0

- Platform: All

Regards,

------------------------------
Boycho Velkov

Original Message:
Sent: Tue July 29, 2025 05:13 AM
From: Doug Lawry
Subject: InformixHQ 3

You may have seen this:

www.ibm.com/support/pages/node/7240777
Security Bulletin: Informix HQ is vulnerable to HTML injection and does not lock out users after multiple incorrect password attempts
28 Jul 2025

The latest version 3.1.0 is described here:

www.ibm.com/docs/en/informix-servers/15.0.0?topic=guide-whats-new-in-informixhq
What's new in InformixHQ
22 Jul 2025

However, I can't find anywhere to download it. Have tried PA, Fix Central, MRS. Similar at HCL.

Meanwhile, IBM IDS 14.10.FC12 contains InformixHQ 3.0.4 which is not documented. It starts normally, but fails with "Invalid message type received from the sqlexec process" when trying to define an IDS server on the same host as HQ (Server Studio works fine). Also tried with 3.0.0 and 3.0.3 with the same result. 2.4.0 works fine.

Any ideas? Will raise with IBM if necessary.

------------------------------
Doug Lawry
Oninit Consulting
------------------------------

Hi

there is an issue with "HQ not able to connect to newer version 14.10.x of the server".

Issue is worked at and a new server version with a fix will be released (hopefully) soon.

Thanks, Boycho. My colleague also found it at Fix Central meanwhile. I could have sworn it wasn't there earlier, but maybe I was using it wrong! We found the easiest way is to specify 3.1.0 as the "Installed server version" which is probably what you did.

I have since tried that with IDS 14.10.FC12 and get the same problem. If InformixHQ 3 doesn't work with IDS 14, then there is no solution to the CVE (or access to new features) unless you are on 15.

Will raise with IBM unless someone responds here today.

Hi Doug,

Try this:

https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EInformation%20Management&product=ibm/Information+Management/Informix&release=3.1.0&platform=All&function=all

In "IBM Support: Fix Central":

- Product selector: Informix Server

- Installed Version: 3.1.0

- Platform: All

Regards,

------------------------------
Boycho Velkov

Original Message:
Sent: Tue July 29, 2025 05:13 AM
From: Doug Lawry
Subject: InformixHQ 3

You may have seen this:

www.ibm.com/support/pages/node/7240777
Security Bulletin: Informix HQ is vulnerable to HTML injection and does not lock out users after multiple incorrect password attempts
28 Jul 2025

The latest version 3.1.0 is described here:

www.ibm.com/docs/en/informix-servers/15.0.0?topic=guide-whats-new-in-informixhq
What's new in InformixHQ
22 Jul 2025

However, I can't find anywhere to download it. Have tried PA, Fix Central, MRS. Similar at HCL.

Meanwhile, IBM IDS 14.10.FC12 contains InformixHQ 3.0.4 which is not documented. It starts normally, but fails with "Invalid message type received from the sqlexec process" when trying to define an IDS server on the same host as HQ (Server Studio works fine). Also tried with 3.0.0 and 3.0.3 with the same result. 2.4.0 works fine.

Any ideas? Will raise with IBM if necessary.

------------------------------
Doug Lawry
Oninit Consulting
------------------------------

Hi

there is an issue with "HQ not able to connect to newer version 14.10.x of the server".

Issue is worked at and a new server version with a fix will be released (hopefully) soon.

Thanks, Boycho. My colleague also found it at Fix Central meanwhile. I could have sworn it wasn't there earlier, but maybe I was using it wrong! We found the easiest way is to specify 3.1.0 as the "Installed server version" which is probably what you did.

I have since tried that with IDS 14.10.FC12 and get the same problem. If InformixHQ 3 doesn't work with IDS 14, then there is no solution to the CVE (or access to new features) unless you are on 15.

Will raise with IBM unless someone responds here today.

Hi Doug,

Try this:

https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EInformation%20Management&product=ibm/Information+Management/Informix&release=3.1.0&platform=All&function=all

In "IBM Support: Fix Central":

- Product selector: Informix Server

- Installed Version: 3.1.0

- Platform: All

Regards,

------------------------------
Boycho Velkov

Original Message:
Sent: Tue July 29, 2025 05:13 AM
From: Doug Lawry
Subject: InformixHQ 3

You may have seen this:

www.ibm.com/support/pages/node/7240777
Security Bulletin: Informix HQ is vulnerable to HTML injection and does not lock out users after multiple incorrect password attempts
28 Jul 2025

The latest version 3.1.0 is described here:

www.ibm.com/docs/en/informix-servers/15.0.0?topic=guide-whats-new-in-informixhq
What's new in InformixHQ
22 Jul 2025

However, I can't find anywhere to download it. Have tried PA, Fix Central, MRS. Similar at HCL.

Meanwhile, IBM IDS 14.10.FC12 contains InformixHQ 3.0.4 which is not documented. It starts normally, but fails with "Invalid message type received from the sqlexec process" when trying to define an IDS server on the same host as HQ (Server Studio works fine). Also tried with 3.0.0 and 3.0.3 with the same result. 2.4.0 works fine.

Any ideas? Will raise with IBM if necessary.

------------------------------
Doug Lawry
Oninit Consulting
------------------------------

Hi

there is an issue with "HQ not able to connect to newer version 14.10.x of the server".

Issue is worked at and a new server version with a fix will be released (hopefully) soon.

------------------------------
Hedwig Fuchs

Original Message:
Sent: Tue July 29, 2025 06:22 AM
From: Doug Lawry
Subject: InformixHQ 3

Thanks, Boycho. My colleague also found it at Fix Central meanwhile. I could have sworn it wasn't there earlier, but maybe I was using it wrong! We found the easiest way is to specify 3.1.0 as the "Installed server version" which is probably what you did.

I have since tried that with IDS 14.10.FC12 and get the same problem. If InformixHQ 3 doesn't work with IDS 14, then there is no solution to the CVE (or access to new features) unless you are on 15.

Will raise with IBM unless someone responds here today.

------------------------------
Doug Lawry
Oninit Consulting

Original Message:
Sent: Tue July 29, 2025 06:10 AM
From: Boycho Velkov
Subject: InformixHQ 3

Hi Doug,

Try this:

https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EInformation%20Management&product=ibm/Information+Management/Informix&release=3.1.0&platform=All&function=all

In "IBM Support: Fix Central":

- Product selector: Informix Server

- Installed Version: 3.1.0

- Platform: All

Regards,

------------------------------
Boycho Velkov

Original Message:
Sent: Tue July 29, 2025 05:13 AM
From: Doug Lawry
Subject: InformixHQ 3

You may have seen this:

www.ibm.com/support/pages/node/7240777
Security Bulletin: Informix HQ is vulnerable to HTML injection and does not lock out users after multiple incorrect password attempts
28 Jul 2025

The latest version 3.1.0 is described here:

www.ibm.com/docs/en/informix-servers/15.0.0?topic=guide-whats-new-in-informixhq
What's new in InformixHQ
22 Jul 2025

However, I can't find anywhere to download it. Have tried PA, Fix Central, MRS. Similar at HCL.

Meanwhile, IBM IDS 14.10.FC12 contains InformixHQ 3.0.4 which is not documented. It starts normally, but fails with "Invalid message type received from the sqlexec process" when trying to define an IDS server on the same host as HQ (Server Studio works fine). Also tried with 3.0.0 and 3.0.3 with the same result. 2.4.0 works fine.

Any ideas? Will raise with IBM if necessary.

------------------------------
Doug Lawry
Oninit Consulting
------------------------------

And InformixHQ 2.4.0 seems to be the last version that works properly with IDS 12.10.FC13 and 14.10.FC4W1.

------------------------------
Doug Lawry
Oninit Consulting

Original Message:
Sent: Tue July 29, 2025 06:30 AM
From: Hedwig Fuchs
Subject: InformixHQ 3

Hi

there is an issue with "HQ not able to connect to newer version 14.10.x of the server".

Issue is worked at and a new server version with a fix will be released (hopefully) soon.

------------------------------
Hedwig Fuchs

Original Message:
Sent: Tue July 29, 2025 06:22 AM
From: Doug Lawry
Subject: InformixHQ 3

Thanks, Boycho. My colleague also found it at Fix Central meanwhile. I could have sworn it wasn't there earlier, but maybe I was using it wrong! We found the easiest way is to specify 3.1.0 as the "Installed server version" which is probably what you did.

I have since tried that with IDS 14.10.FC12 and get the same problem. If InformixHQ 3 doesn't work with IDS 14, then there is no solution to the CVE (or access to new features) unless you are on 15.

Will raise with IBM unless someone responds here today.

------------------------------
Doug Lawry
Oninit Consulting

Original Message:
Sent: Tue July 29, 2025 06:10 AM
From: Boycho Velkov
Subject: InformixHQ 3

Hi Doug,

Try this:

https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EInformation%20Management&product=ibm/Information+Management/Informix&release=3.1.0&platform=All&function=all

In "IBM Support: Fix Central":

- Product selector: Informix Server

- Installed Version: 3.1.0

- Platform: All

Regards,

------------------------------
Boycho Velkov

Original Message:
Sent: Tue July 29, 2025 05:13 AM
From: Doug Lawry
Subject: InformixHQ 3

You may have seen this:

www.ibm.com/support/pages/node/7240777
Security Bulletin: Informix HQ is vulnerable to HTML injection and does not lock out users after multiple incorrect password attempts
28 Jul 2025

The latest version 3.1.0 is described here:

www.ibm.com/docs/en/informix-servers/15.0.0?topic=guide-whats-new-in-informixhq
What's new in InformixHQ
22 Jul 2025

However, I can't find anywhere to download it. Have tried PA, Fix Central, MRS. Similar at HCL.

Meanwhile, IBM IDS 14.10.FC12 contains InformixHQ 3.0.4 which is not documented. It starts normally, but fails with "Invalid message type received from the sqlexec process" when trying to define an IDS server on the same host as HQ (Server Studio works fine). Also tried with 3.0.0 and 3.0.3 with the same result. 2.4.0 works fine.

Any ideas? Will raise with IBM if necessary.

------------------------------
Doug Lawry
Oninit Consulting
------------------------------

You may have seen this:

www.ibm.com/support/pages/node/7240777
Security Bulletin: Informix HQ is vulnerable to HTML injection and does not lock out users after multiple incorrect password attempts
28 Jul 2025

The latest version 3.1.0 is described here:

www.ibm.com/docs/en/informix-servers/15.0.0?topic=guide-whats-new-in-informixhq
What's new in InformixHQ
22 Jul 2025

However, I can't find anywhere to download it. Have tried PA, Fix Central, MRS. Similar at HCL.

Meanwhile, IBM IDS 14.10.FC12 contains InformixHQ 3.0.4 which is not documented. It starts normally, but fails with "Invalid message type received from the sqlexec process" when trying to define an IDS server on the same host as HQ (Server Studio works fine). Also tried with 3.0.0 and 3.0.3 with the same result. 2.4.0 works fine.

Any ideas? Will raise with IBM if necessary.

------------------------------
Doug Lawry
Oninit Consulting
------------------------------

You may have seen this:

www.ibm.com/support/pages/node/7240777
Security Bulletin: Informix HQ is vulnerable to HTML injection and does not lock out users after multiple incorrect password attempts
28 Jul 2025

The latest version 3.1.0 is described here:

www.ibm.com/docs/en/informix-servers/15.0.0?topic=guide-whats-new-in-informixhq
What's new in InformixHQ
22 Jul 2025

However, I can't find anywhere to download it. Have tried PA, Fix Central, MRS. Similar at HCL.

Meanwhile, IBM IDS 14.10.FC12 contains InformixHQ 3.0.4 which is not documented. It starts normally, but fails with "Invalid message type received from the sqlexec process" when trying to define an IDS server on the same host as HQ (Server Studio works fine). Also tried with 3.0.0 and 3.0.3 with the same result. 2.4.0 works fine.

Any ideas? Will raise with IBM if necessary.

The problem is with HQ 3.0 and 3.1 and anything newer or equal to 14.10.FC12W1.
It will be fixed in 14.10.FC12W5 which is the next release which will be available on IBM FixCentral. 

When there is a problem with 12.10., then very likely it is something different and it would be good to get a support case. 

You may have seen this:

www.ibm.com/support/pages/node/7240777
Security Bulletin: Informix HQ is vulnerable to HTML injection and does not lock out users after multiple incorrect password attempts
28 Jul 2025

The latest version 3.1.0 is described here:

www.ibm.com/docs/en/informix-servers/15.0.0?topic=guide-whats-new-in-informixhq
What's new in InformixHQ
22 Jul 2025

However, I can't find anywhere to download it. Have tried PA, Fix Central, MRS. Similar at HCL.

Meanwhile, IBM IDS 14.10.FC12 contains InformixHQ 3.0.4 which is not documented. It starts normally, but fails with "Invalid message type received from the sqlexec process" when trying to define an IDS server on the same host as HQ (Server Studio works fine). Also tried with 3.0.0 and 3.0.3 with the same result. 2.4.0 works fine.

Any ideas? Will raise with IBM if necessary.

Hi Hedwig, Thanks for the info.

We have opened a case with IBM. We are in the process of upgrading a number of Informix instances to 14.10.FC12 and this may delay our schedule. When do you think W5 will be available.?

The problem is with HQ 3.0 and 3.1 and anything newer or equal to 14.10.FC12W1.
It will be fixed in 14.10.FC12W5 which is the next release which will be available on IBM FixCentral. 

When there is a problem with 12.10., then very likely it is something different and it would be good to get a support case. 

You may have seen this:

www.ibm.com/support/pages/node/7240777
Security Bulletin: Informix HQ is vulnerable to HTML injection and does not lock out users after multiple incorrect password attempts
28 Jul 2025

The latest version 3.1.0 is described here:

www.ibm.com/docs/en/informix-servers/15.0.0?topic=guide-whats-new-in-informixhq
What's new in InformixHQ
22 Jul 2025

However, I can't find anywhere to download it. Have tried PA, Fix Central, MRS. Similar at HCL.

Meanwhile, IBM IDS 14.10.FC12 contains InformixHQ 3.0.4 which is not documented. It starts normally, but fails with "Invalid message type received from the sqlexec process" when trying to define an IDS server on the same host as HQ (Server Studio works fine). Also tried with 3.0.0 and 3.0.3 with the same result. 2.4.0 works fine.

Any ideas? Will raise with IBM if necessary.

You may have seen this:

www.ibm.com/support/pages/node/7240777
Security Bulletin: Informix HQ is vulnerable to HTML injection and does not lock out users after multiple incorrect password attempts
28 Jul 2025

The latest version 3.1.0 is described here:

www.ibm.com/docs/en/informix-servers/15.0.0?topic=guide-whats-new-in-informixhq
What's new in InformixHQ
22 Jul 2025

However, I can't find anywhere to download it. Have tried PA, Fix Central, MRS. Similar at HCL.

Meanwhile, IBM IDS 14.10.FC12 contains InformixHQ 3.0.4 which is not documented. It starts normally, but fails with "Invalid message type received from the sqlexec process" when trying to define an IDS server on the same host as HQ (Server Studio works fine). Also tried with 3.0.0 and 3.0.3 with the same result. 2.4.0 works fine.

Any ideas? Will raise with IBM if necessary.