IBM DataPower Gateway vulnerabilities
3 known CVE vulnerabilities in IBM DataPower Gateway, translated and rated.
- CVE-2026-7366Medium
IBM DataPower Gateway versions 11.0.0.0-11.0.0.1, 10.5.0.0-10.5.0.21, and 10.6.0.0-10.6.0.9 have a race condition that results in improper isolation of request state when handling the built-in X-Client-IP header. Under concurrent request processing, X-Client-IP values may be contaminated across requests, enabling IP spoofing and disclosure of other clients' IP addresses.
- CVE-2026-12733High
IBM DataPower Gateway is vulnerable to a denial of service (DoS) due to improper resource limitations. A remote attacker can exploit this to overload the system and disrupt normal operations.
- CVE-2025-36374Medium
IBM DataPower Gateway is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A privileged user could expose sensitive information or consume memory resources.