Description
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper memoization of GraphQL fragment spreads.
Published: 2026-10-08
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

IBM DataPower Gateway devices run the GraphQL engine with a memoization bug that allows a remote attacker to craft repeated fragment spreads, causing the system to crash or exhaust resources. The flaw does not involve authentication or privilege escalation; the attack simply provokes a denial of service, disrupting the availability of the gateway.

Affected Systems

Affected installations include IBM DataPower Gateway 10.5.0 through 10.5.0.22, 10.6.0 through 10.6.0.10, 10.6CD through 10.6.6, and 11.0.0 through 11.0.0.2. Versions in these ranges that have not been updated to the latest fixed releases are vulnerable.

Risk and Exploitability

The CVSS score of 7.5 categorizes the vulnerability as high severity. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, suggesting no commercial exploitation has been documented yet. The likely attack vector is remote access to the GraphQL API, where an attacker sends a specially crafted query containing numerous fragment spreads to trigger the memoization bug and cause a denial of service.

Generated by OpenCVE AI on October 8, 2026 at 16:51 UTC.

Remediation

Vendor Solution

IBM strongly advises upgrading as soon as possible. Known Issue: DT499224 https://www.ibm.com/mysupport/s/defect/aCIgJ000000IiH7/dt499224 Affected VersionsFixed in ReleaseIBM DataPower Gateway 10.6CD 10.6.1 - 10.6.611.0.0.3IBM DataPower Gateway 10.6.0 10.6.0.0 - 10.6.0.1010.6.0.11IBM DataPower Gateway 11.0.0 11.0.0.0 - 11.0.0.211.0.0.3IBM DataPower Gateway 10.5.0 10.5.0.0 - 10.5.0.2210.5.0.23

OpenCVE Recommended Actions

  • Install the latest IBM DataPower Gateway patch that mitigates the memoization issue.
  • If an immediate upgrade is infeasible, disable or tightly restrict the GraphQL interface to prevent exploitation.
  • Enable monitoring for abnormal GraphQL request patterns and rapid request rates to detect attempted abuse early.

Generated by OpenCVE AI on October 8, 2026 at 16:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 00:15:00 +0000

Type Values Removed Values Added
First Time appeared Ibm datapower Gateway
CPEs cpe:2.3:a:ibm:datapower_gateway:*:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datapower_gateway:*:*:*:*:-:*:*:*
cpe:2.3:a:ibm:datapower_gateway:*:*:*:*:continuous_delivery:*:*:*
Vendors & Products Ibm datapower Gateway

Fri, 09 Oct 2026 09:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 08 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Description IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper memoization of GraphQL fragment spreads.
Title IBM DataPower Gateway Denial of Service
First Time appeared Ibm
Ibm datapower Gateway 1050
Ibm datapower Gateway 1060
Ibm datapower Gateway 106cd
Ibm datapower Gateway 1100
Weaknesses CWE-405
CPEs cpe:2.3:a:ibm:datapower_gateway_1050:10.5.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datapower_gateway_1050:10.5.0.22:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datapower_gateway_1060:10.6.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datapower_gateway_1060:10.6.0.10:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datapower_gateway_106cd:10.6.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datapower_gateway_106cd:10.6.6:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datapower_gateway_1100:11.0.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datapower_gateway_1100:11.0.0.2:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm datapower Gateway 1050
Ibm datapower Gateway 1060
Ibm datapower Gateway 106cd
Ibm datapower Gateway 1100
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Ibm Datapower Gateway Datapower Gateway 1050 Datapower Gateway 1060 Datapower Gateway 106cd Datapower Gateway 1100
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-10-08T15:52:04.108Z

Reserved: 2026-07-15T13:19:29.904Z

Link: CVE-2026-15822

cve-icon Vulnrichment

Updated: 2026-10-08T15:51:50.687Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-08T14:16:52.500

Modified: 2026-10-15T00:01:23.893

Link: CVE-2026-15822

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-08T19:00:07Z

Weaknesses
  • CWE-405

    Asymmetric Resource Consumption (Amplification)