IBM DataPower Gateway devices running firmware versions 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 contain a type‑confusion flaw that can be exploited to cause a denial of service. The flaw arises when the gateway processes certain malformed inputs, leading to a corrupted data type and resulting in an application crash. This vulnerability directly impacts the availability of the gateway, potentially disrupting critical data‑flow services that rely on the device.

The affected products are IBM DataPower Gateway versions 10.5.0 (0.0–0.22), 10.6.0 (0.0–0.10), 10.6CD (10.6.1–10.6.6), and 11.0.0 (0.0–0.2). Systems running any of these releases without the specified fixes are vulnerable. IBM lists the affected releases explicitly and provides fixed releases for all four product lines.

Based on the description, it is inferred that an attacker must gain network access to the gateway's management or data planes, or send specially crafted inputs over the supported interfaces. The CVSS score of 7.5 indicates a high‑impact vulnerability, while the EPSS score is not available, suggesting limited published exploitation data. The vulnerability is not currently listed in the CISA KEV catalog. No evidence of active exploitation is reported, but a successful exploit would lead to service unavailability for traffic handled by the gateway. Administrators should treat this as a high‑likelihood threat if the device is exposed to untrusted networks.