IBM DataPower Gateway appliances are vulnerable to an out-of-bounds memory access caused by a strict-weak-ordering violation in a sorting comparator. An attacker can trigger this fault remotely, leading to the appliance becoming unresponsive and resulting in a denial of service. The weakness is identified as CWE‑787 and carries a CVSS score of 7.5, indicating a substantial impact on availability.

All IBM DataPower Gateway deployments running version 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, 11.0.0.0 through 11.0.0.2, and the 10.6CD variant are affected. Fixed releases begin at 10.5.0.23, 10.6.0.11, 10.6.1.12, 10.6.6.3, 11.0.0.3 and later.

The vulnerability can be exploited remotely when an attacker sends input that forces the gateway to execute the flawed comparator, causing memory corruption that crashes the appliance. The CVSS score of 7.5 signifies a high severity. EPSS is not available, and the issue is not listed in the CISA KEV catalog; however, the remote trigger indicates a significant threat for exposed systems.