Critical · published October 8, 2026
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. An unauthenticated remote attacker could overflow the buffer and execute arbitrary code on the system.
| Product | Versions | Fixed in |
|---|---|---|
| ibm/datapower_gateway | ≥ 10.5.0.0, < 10.5.0.23 | 10.5.0.23 |
| ibm/datapower_gateway | ≥ 10.6.0.0, < 10.6.0.11 | 10.6.0.11 |
| ibm/datapower_gateway | ≥ 10.6.1.0, < 11.0.0.3 | 11.0.0.3 |
| ibm/datapower_gateway | ≥ 11.0.0.0, < 11.0.0.3 | 11.0.0.3 |