{"id":"CVE-2026-14507","published":"2026-10-08T15:17:49.283","lastModified":"2026-10-14T20:04:42.920","description":"IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to cause a denial of service due to improper memory allocation during key derivation.","cvssScore":7.7,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","cwes":["CWE-787"],"vendors":["ibm"],"products":["datapower gateway"],"references":[{"url":"https://www.ibm.com/support/pages/node/7289798","tags":["Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM DataPower Gateway suffers from a memory allocation flaw during key derivation that can lead to denial of service when exploited by authenticated remote attackers. This vulnerability allows an attacker to cause system unavailability without requiring special privileges or user interaction.","exploitability":"Exploitation requires an authenticated attacker with access to the DataPower gateway, which is moderately difficult as it needs valid credentials but no complex attack vectors or user interaction.","blast_radius":"If exploited, this vulnerability could disrupt critical network services and API gateways managed by DataPower, potentially affecting multiple applications and users relying on those services.","remediation":"Upgrade to IBM DataPower Gateway 11.0.0.3 or later to remediate this denial of service vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["denial-of-service","gateway","memory-allocation","ibm"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:22:58.797Z"}}