A NULL pointer dereference in the GraphQL variable processing engine causes a crash of the IBM DataPower Gateway, resulting in a denial of service that can interrupt traffic handling. The vulnerability falls under the null pointer dereference category (CWE-476). The compromise could force a gateway restart or period of unavailability for the services it routes.

IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6CD 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 are vulnerable. IBM has released fixes for these releases in the 10.5.0.22, 10.6.0.10, 10.6.1-10.6.6, and 11.0.0.2 update branches.

The CVSS base score of 5.9 indicates medium severity. No EPSS score is currently available, and the vulnerability is not in the CISA KEV catalog, suggesting low observed exploitation likelihood. Due to the nature of the bug, an attacker must send a crafted GraphQL request containing a variable that triggers the NULL dereference; the vector is likely network-based, requiring access to the GraphQL interface exposed by the gateway. Successful exploitation would lead to a gateway crash and a temporary denial of service until the device recovers or is restarted.