CVE-2026-16170: IBM DataPower Gateway Out-of-bounds Write
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a heap buffer overflow.
Other sources
IBM DataPower Gateway could allow a remote attacker to cause a denial of service due to a heap buffer overflow.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM DataPower Gatewayto a version that resolves this vulnerability.Fixed in 11.0.0.3 - Upgrade
Upgrade
IBM DataPower Gatewayto a version that resolves this vulnerability.Fixed in 10.6.0.11 - Upgrade
Upgrade
IBM DataPower Gatewayto a version that resolves this vulnerability.Fixed in 10.5.0.23
Event History
Frequently Asked Questions
Which deployments are affected?
Affected releases are IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2.
Does exploitation require authentication or user interaction?
No. The supplied CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction.
What is the expected impact of successful exploitation?
A remote attacker could cause a denial of service through a heap buffer overflow. The supplied CVSS vector indicates high availability impact and no stated confidentiality or integrity impact.