A flaw in the linked‑list traversal logic of IBM DataPower Gateway versions 10.5.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0 through 10.6.0.10 and 11.0.0 through 11.0.0.2 allows a remote attacker to trigger a denial of service. The compromise is of type CWE‑400, where excessive algorithmic complexity can cause the system to become overwhelmed or unresponsive. The vulnerability does not provide a path to execute code or exfiltrate data, but it can interrupt normal traffic handling and cause service degradation.

The affected products are IBM DataPower Gateway. Vulnerable releases include 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10 and 11.0.0.0 through 11.0.0.2. Fixed releases start with 10.6CD 10.6.1, 10.6.0.0‑10.6.0.11, 10.5.0.0‑10.5.0.23 and 11.0.0.0‑11.0.0.21.

The CVSS score of 5.9 reflects a medium severity risk of service disruption. EPSS is not available, so the likelihood of automated exploitation remains uncertain. The vulnerability is not listed in CISA’s KEV catalog, indicating no public exploits have been reported yet. Attackers would need to craft a request that forces the gateway to perform an inefficient linked‑list traversal, leading to high CPU usage and a blocked service. Remote access is sufficient; no authentication is required.