CVE-2026-16179: CWE-124 Buffer Underwrite ('Buffer Underflow') in IBM DataPower Gateway 10.6CD

This vulnerability (CVE-2026-16179) affects multiple versions of IBM DataPower Gateway including 10.5.0.0 to 10.5.0.22, 10.6.0.0 to 10.6.0.10, 10.6.1 to 10.6.6, and 11.0.0.0 to 11.0.0.2. It is a heap buffer underwrite (CWE-124) that can lead to a denial of service by crashing the service. The CVSS v3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact. The vulnerability allows remote attackers to cause a service crash but does not disclose data or alter data integrity. No vendor advisory or patch information is included in the provided data.

An attacker can remotely cause a heap buffer underwrite in affected IBM DataPower Gateway versions, resulting in a denial of service by crashing the service. There is no impact on confidentiality or integrity according to the CVSS vector. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, monitor IBM security advisories for updates. No specific mitigation steps are provided in the input data.