{"id":"CVE-2026-16178","published":"2026-10-08T13:17:16.067","lastModified":"2026-10-15T00:03:24.233","description":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper input validation.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-787"],"vendors":["ibm"],"products":["datapower gateway"],"references":[{"url":"https://www.ibm.com/support/pages/node/7289775","tags":["Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM DataPower Gateway suffers from a buffer overflow vulnerability (CWE-787) that allows remote attackers to cause a denial of service by sending improperly validated input. This affects multiple versions including 10.5.x, 10.6.x, and 11.0.x series.","exploitability":"Exploitation appears moderately difficult as it requires sending specially crafted input to trigger the buffer overflow, but no public exploit references are available and the vulnerability is limited to denial of service rather than code execution.","blast_radius":"The impact could be significant for organizations relying on DataPower Gateway for API management and security mediation, potentially causing service disruption across multiple applications that depend on it.","remediation":"Upgrade to IBM DataPower Gateway 10.5.0.23 or later, 10.6.7 or later, 10.6.0.11 or later, or 11.0.0.3 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["dos","gateway","api","buffer-overflow"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:27:15.116Z"}}