A heap‑based buffer overflow in IBM DataPower Gateway allows a remote attacker to trigger a denial of service by causing the device to crash or restart. The flaw does not provide remote code execution or privilege escalation, but it can bring the gateway offline, leading to loss of connectivity for any services that depend on it.

Affected products include IBM DataPower Gateway 10.5.0 (versions 10.5.0.0 through 10.5.0.22), 10.6.0 (10.6.0.0 through 10.6.0.10), 10.6CD (10.6.1 through 10.6.6), and 11.0.0 (11.0.0.0 through 11.0.0.2). The vulnerability exists in all listed revisions and requires upgrading to any fixed release cited in the vendor advisory.

The CVSS score of 8.2 categorizes the vulnerability as high severity, while the EPSS score is not available and the issue is not listed in the CISA KEV catalog. The attack vector is remote, as the description specifies a remote attacker can trigger the overflow. Exploitation likely requires sending crafted input to the gateway from a network location that has access to the vulnerable interface. Even without full exploitation, repeated crashes would degrade availability for applications dependent on the gateway.