A remote attacker can trigger uncontrolled resource consumption in IBM DataPower Gateway versions 11.0.0.0 through 11.0.0.2, resulting in a denial of service. The weakness is characterized as a resource exhaustion vulnerability (CWE-400). The impact is a service disruption that could affect all applications relying on the gateway, potentially leading to loss of availability for the affected system.

IBM DataPower Gateway version 11.0.0.0 up to 11.0.0.2 are affected. The fix is available in release 11.0.0.211.0.0.3, which should be deployed to mitigate the issue.

The CVSS score of 7.5 indicates a high severity, though the EPSS score is not available, making the exact exploitation probability unclear. The vulnerability is not listed in CISA’s KEV catalog. It is inferred that the attack vector is remote network-based, where an attacker sends crafted traffic or requests to induce resource depletion, but the exact exploitation method is not described in detail.