Datapower Gateway 11 0 0
Monthly
Race condition in IBM DataPower Gateway across three concurrent version lines (10.5.0.x, 10.6.0.x, and 11.0.0.x) permits state contamination of the built-in X-Client-IP header under concurrent request load, enabling IP spoofing and cross-client IP address disclosure. The flaw resides in IBM's enterprise API gateway and integration middleware, commonly deployed in high-throughput service meshes where simultaneous request processing is routine. IBM has released a patch via advisory 7282770, and no public exploit has been identified at time of analysis.
Denial of service in IBM DataPower Gateway (versions 10.5.0, 10.6.0, 10.6cd, and 11.0.0) allows a remote unauthenticated attacker to exhaust system resources due to improper resource limitations (CWE-770), rendering the gateway unavailable. The CVSS 3.1 base score is 7.5 with an availability-only impact (A:H) and no confidentiality or integrity effect. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but a vendor patch is available.
Race condition in IBM DataPower Gateway across three concurrent version lines (10.5.0.x, 10.6.0.x, and 11.0.0.x) permits state contamination of the built-in X-Client-IP header under concurrent request load, enabling IP spoofing and cross-client IP address disclosure. The flaw resides in IBM's enterprise API gateway and integration middleware, commonly deployed in high-throughput service meshes where simultaneous request processing is routine. IBM has released a patch via advisory 7282770, and no public exploit has been identified at time of analysis.
Denial of service in IBM DataPower Gateway (versions 10.5.0, 10.6.0, 10.6cd, and 11.0.0) allows a remote unauthenticated attacker to exhaust system resources due to improper resource limitations (CWE-770), rendering the gateway unavailable. The CVSS 3.1 base score is 7.5 with an availability-only impact (A:H) and no confidentiality or integrity effect. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but a vendor patch is available.