{"id":"CVE-2026-16170","published":"2026-10-08T13:17:15.660","lastModified":"2026-10-15T00:03:57.897","description":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a heap buffer overflow.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-787"],"vendors":["ibm"],"products":["datapower gateway"],"references":[{"url":"https://www.ibm.com/support/pages/node/7289775","tags":["Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A heap buffer overflow in IBM DataPower Gateway allows remote attackers to cause a denial of service by sending specially crafted input that exceeds allocated buffer boundaries, potentially leading to application crashes or unavailability.","exploitability":"Exploitation appears moderately difficult as it likely requires precise input crafting to trigger the heap overflow, with no public exploits currently available and no clear precondition for successful exploitation.","blast_radius":"The impact could be significant across organizations using DataPower Gateway versions affected by this vulnerability, potentially causing widespread service disruption if multiple gateways are targeted or if the DoS affects critical API or integration services.","remediation":"Upgrade to IBM DataPower Gateway 10.5.0.23, 10.6.7, 10.6.0.11, or 11.0.0.3 to remediate this heap buffer overflow vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["dos","gateway","ibm","heap-overflow"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:27:28.261Z"}}