CVE-2026-15822

Analyzed Analyzed - Analysis Complete

BaseFortify

Publication date: 2026-10-08

Last updated on: 2026-10-15

Assigner: IBM Corporation

Description

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper memoization of GraphQL fragment spreads.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-08

EPSS Evaluated

2026-10-18

NVD

CVE-2026-15822

EUVD

EUVD-2026-94971

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	datapower_gateway	From 11.0.0.0 (inc) to 11.0.0.3 (exc)
ibm	datapower_gateway	From 10.6.1.0 (inc) to 11.0.0.3 (exc)
ibm	datapower_gateway	From 10.6.0.0 (inc) to 10.6.0.11 (exc)
ibm	datapower_gateway	From 10.5.0.0 (inc) to 10.5.0.23 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-405	The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."

Attack-Flow Graph

Executive Summary

IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 have a vulnerability where improper memoization of GraphQL fragment spreads could allow a remote attacker to cause a denial of service.

Detection Guidance

This vulnerability affects IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2. Detection involves checking the installed version of IBM DataPower Gateway against these ranges. Use the command 'show version' or 'show system' in the DataPower CLI to verify the version.

Impact Analysis

This vulnerability could allow an attacker to disrupt services by causing a denial of service, potentially leading to service unavailability or degraded performance for users relying on IBM DataPower Gateway.

Compliance Impact

This vulnerability could lead to a denial of service (DoS) condition in IBM DataPower Gateway, potentially disrupting critical services that handle sensitive data. For GDPR, this may impact availability of personal data processing systems, risking compliance with Article 32 (security of processing). For HIPAA, it could affect the availability of systems handling protected health information, violating the Security Rule's integrity and availability requirements.

Mitigation Strategies

Upgrade IBM DataPower Gateway to a version beyond the affected range (10.5.0.0-10.5.0.22, 10.6.0.0-10.6.6, 10.6.0.0-10.6.0.10, 11.0.0.0-11.0.0.2). Apply patches or updates as soon as they are available from IBM.

Hi! I’m here to help you understand CVE-2026-15822. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70