EUVD-2026-94957
GHSA-9gh8-crxr-x3h2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach network-exposed DataPower Gateway
-
DeliverySend crafted malformed input
-
ExploitTrigger heap buffer underwrite
-
ExecutionCorrupt heap memory
-
ImpactCrash gateway service (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer boundary checks
|
| Exploitation Conditions | No special configuration conditions are stated in the description - the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote, unauthenticated exploitation reachable over the network against affected DataPower Gateway firmware versions. The practical limiting factor is network reachability: the attacker must be able to reach the gateway's exposed service/listener (internet-facing, partner-facing, or internal network position). Impact is bounded to availability - a service crash - with no path to data disclosure or code execution per the C:N/I:N/A:H impact metrics. Only the listed firmware versions (10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6, 11.0.0.0-11.0.0.2) are affected, which limits exposure to unpatched deployments. |
| Impact | This is a moderate-severity availability issue, not an urgent priority despite the 7.5 CVSS. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a remote, unauthenticated, low-complexity attack, which raises the base score, but the impact metrics are the key tempering signal: C:N/I:N/A:H means the only consequence is a service crash (denial of service), with no confidentiality or integrity loss - consistent with the CWE-124 heap buffer underwrite and the 'Denial Of Service' tag. No EPSS score, KEV listing, or POC was provided in the input; per the precision rules this means no public exploit is identified at time of analysis and there is no evidence of active exploitation. The signals are internally consistent (no conflicts): network-reachable DoS against an IBM appliance, confirmed only by the IBM PSIRT advisory. Real-world risk is driven by exposure - DataPower Gateways are often internet- or partner-facing - but the ceiling is availability disruption, not compromise, so this should be patched on a normal maintenance cadence rather than treated as an emergency. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a specially crafted request or malformed input to a network-reachable IBM DataPower Gateway, triggering a heap buffer underwrite that corrupts memory and crashes the service, interrupting API/traffic processing for all downstream consumers. No public exploit code was identified in the provided data, and the impact is limited to denial of service (no code execution or data exposure indicated). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
A heap buffer underwrite in IBM DataPower Gateway allows unauthenticated remote attackers to crash the gateway service, producing a denial-of-service condition on affected appliances. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), the flaw is reachable over the network with no privileges or user interaction required, and impact is confined to availability (C:N/I:N/A:H). Affected firmware spans 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
RemediationAI
No vendor-released patch version is identified in the available input data, so remediation must start by retrieving IBM Support document 7289775 (https://www.ibm.com/support/pages/node/7289775) and applying the fixed firmware build IBM specifies for each affected train (10.5.0.x, 10.6.0.x, 10.6.1-10.6.6, and 11.0.0.x); per the precision rules this is recorded as no fixed version independently confirmed from the data provided, not as a statement that no fix exists. Until the corrected build is applied, the practical compensating controls all hinge on reducing network reachability to the vulnerable listener, because the assessed vector shows remote, unauthenticated triggering with no special configuration prerequisite: restrict inbound access to DataPower data and management interfaces with firewall/ACL rules or a reverse proxy so that only known partner and client networks can reach the gateway, accepting the operational cost that legitimate external integrations must be re-homed or explicitly allow-listed; front the gateway with a WAF or XML/JSON inspection layer to reject malformed request bodies, with the trade-off of added latency, possible false positives on legitimate payloads, and the fact that signature coverage for a CWE-124 underwrite is inherently incomplete; and enable service auto-restart / high-availability failover or process health monitoring so a successful crash is recovered quickly, at the cost of brief outages and possible dropped in-flight transactions on restart. Because impact is limited to availability and no public exploit code has been identified, prioritization can follow the moderate risk assessment rather than an emergency change window, but internet-facing or partner-facing gateways should be mitigated first.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-124, Buffer Underwrite ('Buffer Underflow'), in which a memory write occurs at an address located before the start of an allocated heap buffer. This typically arises when a length, offset, or index value derived from parsed input is decremented or underflowed (for example, a size calculation that subtracts before validating), causing metadata adjacent to the allocation to be corrupted. In the DataPower Gateway context this means malformed or specially crafted input reaching a parsing or message-processing path on an exposed listener can corrupt heap structures and terminate the service. CPE data was not provided in the input; the affected product line is identified by the vendor as IBM DataPower Gateway across the 10.5.x, 10.6.x, and 11.0.x firmware trains. Critically, the assessed impact metrics (C:N/I:N/A:H) bound the outcome to a crash of the service - the corruption does not translate into data disclosure or code execution within the assessed scenario, so this should be treated as a reliability/availability defect rather than a memory-corruption path to remote code execution.
Know when Datapower Gateway gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable unauthenticated DoS with no user interaction (AV:N/AC:L/PR:N/UI:N); heap underwrite crashes the service for availability-only impact (A:H, C/I:N).
Primary rating from Vendor (us).
CVSS VectorVendor: us
DescriptionCVE.org
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a heap buffer underwrite and potentially crash the service.
Executive ViewAI
IBM DataPower Gateway, a widely deployed API and integration security appliance, is affected by a remotely reachable flaw across firmware branches 10.5.0.x, 10.6.x, and 11.0.0.x that lets an unauthenticated network attacker crash the gateway service, causing a denial-of-service outage. Because DataPower appliances typically sit on the perimeter brokering authentication, API traffic, and partner integrations, a successful crash can interrupt customer-facing services and internal application connectivity for the duration of each outage. Any organization running an unpatched appliance in an internet-reachable path should treat this as an availability risk requiring immediate mitigation planning, even though no public exploit code or active exploitation has been observed.
No vendor-released patch identified at time of analysis. Interim controls: restrict network reachability of affected appliances to trusted sources only, place exposed DataPower services behind rate limiting and traffic filtering, disable or firewall unnecessary internet-facing endpoints, validate high-availability failover and load balancing to absorb a single-appliance crash, monitor for service restarts or abnormal process termination, and isolate affected appliances in a segmented network zone while awaiting a vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Datapower Gateway
View allRemote, unauthenticated code execution is possible in IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.0.
IBM DataPower Gateway 7.6.0.0-7 throug 6.0.14 and 2018.4.1.0 through 2018.4.1.5 have a default administrator account tha
IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21
IBM DataPower Gateway V10CD, 10.0.1, and 2018.4.1 is vulnerable to cross-site request forgery which could allow an attac
IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21
IBM DataPower Gateways 7.5, 7.5.1, 7.5.2, and 7.6 is vulnerable to cross-site request forgery which could allow an attac
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.6, 7.6.0.0 through 7.6.0.15 and IBM MQ Appliance 8.0.0.0 through 8.0.0
IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15
A heap buffer overflow in IBM DataPower Gateway (affected firmware levels 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 1
Denial of service in IBM DataPower Gateway allows a remote, unauthenticated attacker to crash or degrade an affected gat
Denial of service in IBM DataPower Gateway allows a remote, unauthenticated attacker to crash or exhaust the message-pro
Unauthenticated remote attackers can exhaust system resources on IBM DataPower Gateway firmware releases 11.0.0.0 throug
Exploit-DB