CVE-2026-12733

IBM DataPower Gateway affected by denial of service

Published Jul 30, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

IBM DataPower Gateway could allow a remote attacker to cause a denial of service due to improper resource limitations.

Analysis

Technical impact

IBM DataPower Gateway can be remotely triggered to exhaust system resources, causing a denial of service. The flaw is rooted in improper resource limitations and falls under CWE‑770; it impacts availability but does not directly compromise confidentiality or integrity.

Affected Systems

Vulnerable IBM DataPower Gateway firmware includes versions 10.5.0, 10.6.0, 10.6CD, and 11.0.0. The issue applies to all releases in these product lines listed above.

Risk and Exploitability

The CVSS base score of 7.5 indicates a high severity. The EPSS score of 0.00313 indicates a low exploitation probability, and the vulnerability is not currently flagged in CISA KEV. An attacker can remotely exploit the flaw over HTTP/2 traffic, leading to a service outage unless mitigated.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

IBM

DataPower Gateway 10.6CD

affected

Version	Status	Constraints
`10.6.1`	affected	≤ 10.6.6

IBM

DataPower Gateway 10.6.0

affected

Version	Status	Constraints
`10.6.0.0`	affected	≤ 10.6.0.9

IBM

DataPower Gateway 11.0.0

affected

Version	Status	Constraints
`11.0.0.0`	affected	≤ 11.0.0.1

IBM

DataPower Gateway 10.5.0

affected

Version	Status	Constraints
`10.5.0.0`	affected	≤ 10.5.0.21

Configuration 1 [-]

OR	cpe:2.3:a:ibm:datapower_gateway::::::::
	cpe:2.3:a:ibm:datapower_gateway::::::::
	cpe:2.3:a:ibm:datapower_gateway:::::continuous_delivery:::*
	cpe:2.3:a:ibm:datapower_gateway::::::::

No data.

Vendor Product Versions

Ibm

Datapower Gateway 1050

Version	Status	Scheme	Platform
`[10.5.0.0,10.5.0.21]`	affected	generic	—

Ibm

Datapower Gateway 1060

Version	Status	Scheme	Platform
`[10.6.0.0,10.6.0.9]`	affected	generic	—

Ibm

Datapower Gateway 106cd

Version	Status	Scheme	Platform
`[10.6.1,10.6.6]`	affected	semver	—

Ibm

Datapower Gateway 1100

Version	Status	Scheme	Platform
`[11.0.0.0,11.0.0.1]`	affected	generic	—

Remediation

Vendor Solution

Affected Product(s)Fixed in ReleaseFix InstructionsIBM DataPower Gateway 10.6CD 10.6.1 - 10.6.611.0.0.2 https://www.ibm.com/docs/en/datapower-gateway/11.0.0?topic=overview-release-notes#relnotes__install__title__1 IBM DataPower Gateway 10.6.0 10.6.0.0 - 10.6.0.910.6.0.10 https://www.ibm.com/docs/en/datapower-gateway/10.6.0?topic=overview-release-notes#relnotes__install__title__1 IBM DataPower Gateway 11.0.0 11.0.0.0 - 11.0.0.111.0.0.2 https://www.ibm.com/docs/en/datapower-gateway/11.0.0?topic=overview-release-notes#relnotes__install__title__1 IBM DataPower Gateway 10.5.0 10.5.0.0 - 10.5.0.2110.5.0.22 https://www.ibm.com/docs/en/datapower-gateway/10.5.0?topic=overview-release-notes#relnotes__install__title__1 https://www.ibm.com/docs/en/datapower-gateway/11.0.0 IBM strongly advises upgrading as soon as possible.

Vendor Workaround

Disable HTTP/2.

OpenCVE Recommended Actions

Upgrade the IBM DataPower Gateway to a version that includes the fix—10.5.0.2110.5.0.22 or later, 10.6.0.910.6.0.10 or later, 10.6.1‑10.6.611.0.0.2 for 10.6CD, or 11.0.0.111.0.0.2 for 11.0.0. This resolves the insufficient resource‑limitation problem.
If an upgrade cannot be applied immediately, disable HTTP/2 in the DataPower configuration to mitigate attack vectors until the patch is available.
Add monitoring or rate‑limiting rules for HTTP/2 connections to detect and throttle abnormal traffic patterns, helping to protect the appliance until a formal fix is.

Generated by OpenCVE AI on August 3, 2026 at 10:37 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.549% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://www.ibm.com/support/pages/node/7278746

History

Jul 31, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 30, 2026 6:30 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		IBM DataPower Gateway could allow a remote attacker to cause a denial of service due to improper resource limitations.
Title		IBM DataPower Gateway affected by denial of service
First Time appeared		Ibm Ibm datapower Gateway 1050 Ibm datapower Gateway 1060 Ibm datapower Gateway 106cd Ibm datapower Gateway 1100
Weaknesses		CWE-770
CPEs		cpe:2.3:a:ibm:datapower_gateway_1050:10.5.0.0:::::::* cpe:2.3:a:ibm:datapower_gateway_1050:10.5.0.21:::::::* cpe:2.3:a:ibm:datapower_gateway_1060:10.6.0.0:::::::* cpe:2.3:a:ibm:datapower_gateway_1060:10.6.0.9:::::::* cpe:2.3:a:ibm:datapower_gateway_106cd:10.6.1:::::::* cpe:2.3:a:ibm:datapower_gateway_106cd:10.6.6:::::::* cpe:2.3:a:ibm:datapower_gateway_1100:11.0.0.0:::::::* cpe:2.3:a:ibm:datapower_gateway_1100:11.0.0.1:::::::*
Vendors & Products		Ibm Ibm datapower Gateway 1050 Ibm datapower Gateway 1060 Ibm datapower Gateway 106cd Ibm datapower Gateway 1100
References		https://www.ibm.com/support/pages/node/7278746
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`