EUVD-2026-94891
GHSA-645j-3fmg-jcf5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed DataPower network endpoint
-
DeliverySend message with malformed length field
-
ExploitTrigger faulty memory reallocation
-
ExecutionExhaust/corrupt gateway memory
-
ImpactDenial of service / gateway outage
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to an IBM DataPower Gateway running an affected firmware level (10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6, or 11.0.0.0-11.0.0.2) and the ability to send a message whose length field is processed during memory reallocation. Per the CVSS vector (PR:N/UI:N/AC:L) no authentication, user interaction, or special non-default configuration is documented; the primary limiting factor is network exposure of the gateway's message-processing interface, so appliances restricted to trusted internal segments face materially lower risk than internet- or partner-facing deployments. Impact is limited to availability - there is no confidentiality or integrity effect. |
| Impact | This is a genuine but bounded availability risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remote, low-complexity, unauthenticated attack requiring no user interaction, which is why it scores 7.5 HIGH - but the impact is confined entirely to availability (C:N/I:N/A:H), consistent with CWE-770-style resource exhaustion via improper length-field validation during memory reallocation. No confidentiality or integrity exposure exists, so this is a service-disruption issue, not a path to code execution or data theft. Key corroborating signals are ABSENT from the input: no EPSS score, no CISA KEV listing, and no POC indicator are provided, so there is 'no public exploit identified at time of analysis' and no evidence of active exploitation. SSVC inputs (exploitation status, automatable, technical impact) were not supplied. The practical priority is therefore moderate: easy to trigger in theory and exposed to the network, but the worst outcome is a gateway outage, and the absence of EPSS/KEV/POC data means there is no indication this is being weaponized. Prioritize patching for internet- or partner-facing DataPower appliances where uptime is critical; deprioritize relative to any concurrent RCE or data-exposure CVEs. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a specially crafted message with a manipulated length field to an exposed IBM DataPower Gateway endpoint. During memory reallocation the improperly validated length triggers abnormal resource handling, crashing or hanging the gateway and denying service to all legitimate API/integration traffic routed through it. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Denial of service in IBM DataPower Gateway allows a remote, unauthenticated attacker to crash or exhaust the message-processing service by sending crafted messages whose length field is mishandled during memory reallocation. All firmware levels in the ranges 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 are affected; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) indicates no authentication, user interaction, or non-default configuration is needed, and the only impact is loss of availability. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but because exploitation only requires network reachability to the gateway's message interface, internet- or partner-facing appliances should be treated as the highest-priority remediation targets.
RemediationAI
No vendor-released patch version is identified in the available input data (the sole reference is the IBM support page https://www.ibm.com/support/pages/node/7289775, which should be treated as the authoritative source for fix levels per stream; absence of a confirmed version here is not evidence that no fix exists). In practice, upgrade each affected stream to the fixed firmware level IBM documents for 10.5.0.x, 10.6.0.x, 10.6.1.x, and 11.0.0.x, and restart the affected domain or appliance after the update since the defect is in the message-processing path. Until an upgrade can be scheduled, reduce exposure by ensuring the gateway's message interfaces are not directly reachable from the internet or untrusted partner networks - front them with a load balancer, WAF, or reverse proxy that enforces strict maximum message/body sizes, header length limits, and request rate limiting; the trade-off is that legitimate large-payload integrations (SOAP/XML with big attachments, MQ message flows) may be rejected and will need per-service size tuning. If a specific service is not needed externally, disable or unbind that front-side handler entirely, accepting the loss of functionality in exchange for removing the attack surface. Monitor gateway memory and process restarts for anomalous spikes as a detection signal, and restrict management and debug interfaces to trusted administration segments.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an uncontrolled resource consumption / allocation issue (CWE-770: Allocation of Resources Without Limits or Throttling) rooted in improper validation of a length field that is trusted when a buffer or object is reallocated in memory. IBM DataPower Gateway is a hardened multi-protocol security and integration appliance that terminates and proxies traffic such as HTTP/HTTPS, MQ, FTP, and web services, performing XML/JSON transformation, policy enforcement, and signature/crypto processing in its message pipeline. Because those handlers must allocate and grow buffers based on length values carried in the incoming message, a length field that is inconsistent with the actual payload - or that drives an unbounded reallocation - can force repeated or oversized allocations, exhausting memory or triggering a fault that takes the service down. The attack surface is therefore the network-facing message-processing interface rather than an administrative or local path, which is consistent with the AV:N/AC:L/PR:N/UI:N vector in the independent assessment. No CPE strings were supplied with the intelligence, so exact platform/build identifiers should be confirmed against the version ranges in IBM's advisory.
Know when Datapower Gateway gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated attacker sends a crafted length field with no interaction (AV:N/AC:L/PR:N/UI:N); impact is availability-only resource exhaustion (A:H, C:N/I:N).
Primary rating from Vendor (us).
CVSS VectorVendor: us
DescriptionCVE.org
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper validation of the length field during memory reallocation.
Executive ViewAI
IBM DataPower Gateway's message-processing service is exposed to a high-severity denial-of-service flaw that can be triggered remotely without authentication, potentially causing unplanned outages for applications and partner integrations that rely on the gateway. Organizations with internet- or partner-facing gateways face the greatest operational disruption, as a successful attack could halt message processing and impact service-level commitments. Leadership should treat externally exposed instances as urgent remediation priorities.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to the message-processing interface to trusted sources; deploy network segmentation; enable rate limiting and anomaly detection; monitor for service crashes; and maintain redundant gateway instances for failover.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Datapower Gateway
View allRemote, unauthenticated code execution is possible in IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.0.
IBM DataPower Gateway 7.6.0.0-7 throug 6.0.14 and 2018.4.1.0 through 2018.4.1.5 have a default administrator account tha
IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21
IBM DataPower Gateway V10CD, 10.0.1, and 2018.4.1 is vulnerable to cross-site request forgery which could allow an attac
IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21
IBM DataPower Gateways 7.5, 7.5.1, 7.5.2, and 7.6 is vulnerable to cross-site request forgery which could allow an attac
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.6, 7.6.0.0 through 7.6.0.15 and IBM MQ Appliance 8.0.0.0 through 8.0.0
IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15
A heap buffer overflow in IBM DataPower Gateway (affected firmware levels 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 1
Denial of service in IBM DataPower Gateway allows a remote, unauthenticated attacker to crash or degrade an affected gat
Unauthenticated remote attackers can exhaust system resources on IBM DataPower Gateway firmware releases 11.0.0.0 throug
A heap buffer underwrite in IBM DataPower Gateway allows unauthenticated remote attackers to crash the gateway service,
Exploit-DB