IBM DataPower Gateway firmware versions up to 10.5.0.22, 10.6.0.10, 10.6.6, and 11.0.0.2 contain a heap-based buffer overflow that a remote attacker can exploit to cause a denial of service. The issue is classified as CWE‑125, indicating an unsafe access to memory outside a buffer's bounds.

Affected products are IBM DataPower Gateway 10.5.0, 10.6.0, 10.6CD, and 11.0.0. Vulnerable firmware revisions range from 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2. All hardware and software variants of these firmware versions are affected until the device is updated to a fixed release.

The CVSS score of 8.2 signals a high‑severity denial of service vulnerability. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog, so exploitation likelihood remains uncertain. The problem is reachable from a remote attacker without prior authentication, implying that the vulnerability can be triggered by network traffic to exposed management interfaces. Therefore, maintaining strict access controls on administrative interfaces and promptly applying vendor updates are critical to preventing exploitation.