VDB

CVE-2026-16176

CVE-2026-16176 PUBLISHED CVSS 7.5 HIGH

Reported by ibm · Published October 8, 2026

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper validation of the length field during memory reallocation.

Risk Scores

CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products

VendorProductVersions
IBMDataPower Gateway 10.6CD10.6.1
IBMDataPower Gateway 10.6.010.6.0.0
IBMDataPower Gateway 11.0.011.0.0.0
IBMDataPower Gateway 10.5.010.5.0.0
IBMDataPower Gateway 10.5.010.5.0.0
IBMDataPower Gateway 10.6CD10.6.1
IBMDataPower Gateway 11.0.011.0.0.0
IBMDataPower Gateway 10.6.010.6.0.0

Timeline

  • Sep 28, 2026 CVE Published
  • Oct 9, 2026 EPSS Score
  • Oct 13, 2026 EPSS Score
  • Oct 14, 2026 EPSS Score

References

  • vendor-advisorypatch
Open in Interactive Console →
$ Console Community · 100/wk Open console ›