EUVD-2026-51259
GHSA-wg6c-2573-m6q2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated low-complexity trigger (AV:N/AC:L/PR:N/UI:N) with availability-only impact (A:H, C:N/I:N) consistent with an unthrottled-resource DoS.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
2DescriptionCVE.org
IBM DataPower Gateway could allow a remote attacker to cause a denial of service due to improper resource limitations.
AnalysisAI
Denial of service in IBM DataPower Gateway (versions 10.5.0, 10.6.0, 10.6cd, and 11.0.0) allows a remote unauthenticated attacker to exhaust system resources due to improper resource limitations (CWE-770), rendering the gateway unavailable. The CVSS 3.1 base score is 7.5 with an availability-only impact (A:H) and no confidentiality or integrity effect. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions are required beyond network access to an affected IBM DataPower Gateway listener - remote, unauthenticated, low-complexity triggering against reachable instances. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes an easily reachable, unauthenticated, low-complexity network attack, which supports treating this as a genuine availability concern for internet- or partner-facing gateways. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A remote attacker with network reach to an exposed DataPower listener sends a stream of specially crafted or high-volume requests that each cause the gateway to allocate resources without an enforced limit. As allocations accumulate faster than they are freed, the appliance exhausts memory or connection capacity and stops servicing legitimate API traffic. … |
| Remediation | Patch available per vendor advisory: apply the fix referenced in IBM's bulletin at https://www.ibm.com/support/pages/node/7278746 for your specific release train (10.5.0, 10.6.0, 10.6cd, or 11.0.0); the exact fixed build number is not stated in the available data and should be taken from that advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Immediately inventory all IBM DataPower Gateway deployments to identify instances running versions 10.5.0, 10.6.0, 10.6cd, or 11.0.0 and assess their business criticality (within 24 hours). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Datapower Gateway 10 6Cd
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today