The vulnerability is an out-of-bounds write that can be triggered by remote attackers sending specifically crafted requests to the DataPower Gateway. This flaw permits the creation of invalid memory writes, leading to an abrupt process termination and causing a denial of service. The weakness matches CWE-787, indicating a bounds‑checking failure in input handling.

Affected are IBM’s DataPower Gateway products for versions 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, 11.0.0.0 through 11.0.0.2, and the 10.6CD build 10.6.1x. Devices running any of these releases should verify their firmware and upgrade to the fixed releases specified by IBM: 10.5.0.23 or later, 10.6.0.11 or later, 10.6.1.0 or later, 11.0.0.3 or later, or 10.6CD 10.6.611.0.0.3.

The CVSS score of 7.5 indicates high severity, and although the EPSS score is not available, the lack of a KEV listing does not reduce the risk for high‑profile networks. The flaw is exploitable over the network, presumably from any device that can reach the gateway’s management or data planes, and an attacker only needs to craft malformed input to trigger the crash. Consequently, the primary risk is that an adversary can interrupt service availability on the affected gateway.