{"id":"CVE-2026-16176","published":"2026-10-08T13:17:15.797","lastModified":"2026-10-15T00:03:48.087","description":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper validation of the length field during memory reallocation.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-770"],"vendors":["ibm"],"products":["datapower gateway"],"references":[{"url":"https://www.ibm.com/support/pages/node/7289775","tags":["Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM DataPower Gateway suffers from a memory reallocation vulnerability where improper validation of length fields can lead to heap-based buffer overflows during dynamic memory allocation, potentially causing denial of service conditions.","exploitability":"Exploitation appears difficult without additional vulnerabilities or specific input conditions, requiring precise control over memory allocation patterns and likely limited to remote attackers with network access to the DataPower gateway services.","blast_radius":"If exploited, this vulnerability could disrupt critical API gateway and integration services, affecting multiple applications and users relying on DataPower's routing and transformation capabilities.","remediation":"Upgrade to IBM DataPower Gateway 10.5.0.23 or 10.6.7 or 11.0.3 to address this memory reallocation flaw.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["denial-of-service","memory-corruption","gateway"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:27:20.959Z"}}