🚨 CVE-2026-15824
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a heap-based buffer overflow.
🎖@cveNotify
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a heap-based buffer overflow.
🎖@cveNotify
Ibm
Security Bulletin: IBM DataPower Gateway affected by multiple CVEs
IBM DataPower Gateway has addressed multiple vulnerabilities versions 11.0.0.3, 10.6.0.11, and 10.5.0.23
🚨 CVE-2026-16111
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a denial of service due to a type confusion flaw.
🎖@cveNotify
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a denial of service due to a type confusion flaw.
🎖@cveNotify
Ibm
Security Bulletin: IBM DataPower Gateway affected by multiple CVEs
IBM DataPower Gateway has addressed multiple vulnerabilities versions 11.0.0.3, 10.6.0.11, and 10.5.0.23
🚨 CVE-2026-16159
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to obtain sensitive information and cause a denial of service due to an out-of-bounds write.
🎖@cveNotify
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to obtain sensitive information and cause a denial of service due to an out-of-bounds write.
🎖@cveNotify
Ibm
Security Bulletin: IBM DataPower Gateway affected by multiple CVEs
IBM DataPower Gateway has addressed multiple vulnerabilities versions 11.0.0.3, 10.6.0.11, and 10.5.0.23
🚨 CVE-2026-16161
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.
🎖@cveNotify
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.
🎖@cveNotify
Ibm
Security Bulletin: IBM DataPower Gateway affected by multiple CVEs
IBM DataPower Gateway has addressed multiple vulnerabilities versions 11.0.0.3, 10.6.0.11, and 10.5.0.23
🚨 CVE-2026-16163
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause memory corruption due to an out-of-bounds write.
🎖@cveNotify
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause memory corruption due to an out-of-bounds write.
🎖@cveNotify
Ibm
Security Bulletin: IBM DataPower Gateway affected by multiple CVEs
IBM DataPower Gateway has addressed multiple vulnerabilities versions 11.0.0.3, 10.6.0.11, and 10.5.0.23
🚨 CVE-2026-16164
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a buffer overflow.
🎖@cveNotify
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a buffer overflow.
🎖@cveNotify
Ibm
Security Bulletin: IBM DataPower Gateway affected by multiple CVEs
IBM DataPower Gateway has addressed multiple vulnerabilities versions 11.0.0.3, 10.6.0.11, and 10.5.0.23
🚨 CVE-2026-16165
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a null pointer dereference.
🎖@cveNotify
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a null pointer dereference.
🎖@cveNotify
Ibm
Security Bulletin: IBM DataPower Gateway affected by multiple CVEs
IBM DataPower Gateway has addressed multiple vulnerabilities versions 11.0.0.3, 10.6.0.11, and 10.5.0.23
🚨 CVE-2026-16167
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper bounds checking.
🎖@cveNotify
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper bounds checking.
🎖@cveNotify
Ibm
Security Bulletin: IBM DataPower Gateway affected by multiple CVEs
IBM DataPower Gateway has addressed multiple vulnerabilities versions 11.0.0.3, 10.6.0.11, and 10.5.0.23
🚨 CVE-2026-13257
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an authenticated user to forge signature requests due to improper verification of data authenticity.
🎖@cveNotify
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an authenticated user to forge signature requests due to improper verification of data authenticity.
🎖@cveNotify
Ibm
Security Bulletin: IBM DataPower Gateway affected by multiple CVEs
IBM DataPower Gateway has addressed multiple vulnerabilities versions 11.0.0.3, 10.6.0.11, and 10.5.0.23
🚨 CVE-2026-13258
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
🎖@cveNotify
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
🎖@cveNotify
Ibm
Security Bulletin: IBM DataPower Gateway affected by multiple CVEs
IBM DataPower Gateway has addressed multiple vulnerabilities versions 11.0.0.3, 10.6.0.11, and 10.5.0.23
🚨 CVE-2026-14269
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. An unauthenticated remote attacker could overflow the buffer and execute arbitrary code on the system.
🎖@cveNotify
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. An unauthenticated remote attacker could overflow the buffer and execute arbitrary code on the system.
🎖@cveNotify
Ibm
Security Bulletin: IBM DataPower Gateway affected by multiple CVEs
IBM DataPower Gateway has addressed multiple vulnerabilities versions 11.0.0.3, 10.6.0.11, and 10.5.0.23
🚨 CVE-2026-14273
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a local attacker to obtain sensitive information due to improper authorization.
🎖@cveNotify
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a local attacker to obtain sensitive information due to improper authorization.
🎖@cveNotify
Ibm
Security Bulletin: IBM DataPower Gateway affected by multiple CVEs
IBM DataPower Gateway has addressed multiple vulnerabilities versions 11.0.0.3, 10.6.0.11, and 10.5.0.23
🚨 CVE-2026-14496
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a heap-based buffer overflow.
🎖@cveNotify
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a heap-based buffer overflow.
🎖@cveNotify
Ibm
Security Bulletin: IBM DataPower Gateway affected by multiple CVEs
IBM DataPower Gateway has addressed multiple vulnerabilities versions 11.0.0.3, 10.6.0.11, and 10.5.0.23
🚨 CVE-2026-14497
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to bypass security restrictions due to improper verification of cryptographic signatures.
🎖@cveNotify
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to bypass security restrictions due to improper verification of cryptographic signatures.
🎖@cveNotify
Ibm
Security Bulletin: IBM DataPower Gateway affected by multiple CVEs
IBM DataPower Gateway has addressed multiple vulnerabilities versions 11.0.0.3, 10.6.0.11, and 10.5.0.23
🚨 CVE-2026-14502
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to obtain administrative access due to failure to reject empty passwords during LDAP authentication.
🎖@cveNotify
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to obtain administrative access due to failure to reject empty passwords during LDAP authentication.
🎖@cveNotify
Ibm
Security Bulletin: IBM DataPower Gateway affected by multiple CVEs
IBM DataPower Gateway has addressed multiple vulnerabilities versions 11.0.0.3, 10.6.0.11, and 10.5.0.23
🚨 CVE-2026-107675
FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged media, or receive uploaded output.
🎖@cveNotify
FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged media, or receive uploaded output.
🎖@cveNotify
FFmpeg Forgejo
avformat/libssh: verify the SSH server host key · 2b822b7fb6
The sftp protocol connected and authenticated without checking the server
host key, so credentials were sent to any or spoofed server. Verify against
known_hosts (ssh_session_is_known_server, with a pre-0.8 fallback) before
authenticating; add a 'verify'…
host key, so credentials were sent to any or spoofed server. Verify against
known_hosts (ssh_session_is_known_server, with a pre-0.8 fallback) before
authenticating; add a 'verify'…
🚨 CVE-2026-107676
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcoding writes leaked process memory into output files.
🎖@cveNotify
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcoding writes leaked process memory into output files.
🎖@cveNotify
FFmpeg Forgejo
avutil/hdr_dynamic_metadata: fix uninitialized bytes when color saturation is set without tone mapping · 2c2f6e96e3
The write loop in av_dynamic_hdr_plus_to_t35() nested the
color_saturation_mapping_flag and color_saturation_weight put_bits
calls inside the tone_mapping_flag block, while the size calculation
and the parser treat these fields as unconditional per window.…
color_saturation_mapping_flag and color_saturation_weight put_bits
calls inside the tone_mapping_flag block, while the size calculation
and the parser treat these fields as unconditional per window.…
🚨 CVE-2026-107677
FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media="" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely.
🎖@cveNotify
FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media="" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely.
🎖@cveNotify
FFmpeg Forgejo
avutil/avstring: fix infinite loop in av_strireplace with empty search string · ed27bfcbbb
av_stristr() returns the input pointer unchanged for an empty needle,
so an empty 'from' argument left pstr never advancing and caused
av_strireplace() to loop forever (and grow the buffer unboundedly if
'to' was non-empty). Return a duplicate of 'str' when…
so an empty 'from' argument left pstr never advancing and caused
av_strireplace() to loop forever (and grow the buffer unboundedly if
'to' was non-empty). Return a duplicate of 'str' when…
🚨 CVE-2026-107678
FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption.
🎖@cveNotify
FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption.
🎖@cveNotify
FFmpeg Forgejo
avutil/encryption_info: avoid stack exhaustion freeing init info list
Fixes: Stack overflow
Found-by: Joshua Rogers <joshua.rogers@aisle.com>
Fixes: tyKGcmR25mD8
Found-by: Joshua Rogers <joshua.rogers@aisle.com>
Fixes: tyKGcmR25mD8
🚨 CVE-2026-107695
FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption.
🎖@cveNotify
FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption.
🎖@cveNotify
FFmpeg Forgejo
avformat/hls: reject Master Playlist tags in a Media Playlist
Fixes: recursion.m3u8
Fixes: cEy2cxyyPaLH
Fixes: cd223e0b4e (Add Apple HTTP Live Streaming demuxer)
Found-by: BapToutatis
Fixes: cEy2cxyyPaLH
Fixes: cd223e0b4e (Add Apple HTTP Live Streaming demuxer)
Found-by: BapToutatis
🚨 CVE-2026-107696
FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core.
🎖@cveNotify
FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core.
🎖@cveNotify
FFmpeg Forgejo
avformat/rtsp: limit the number of redirects
Fixes: 2OgPp3duxpWM
Found-by: BapToutatis
Endless redirect loop Replicated through UnModified FFmpeg with rogue RTSP servers
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Found-by: BapToutatis
Endless redirect loop Replicated through UnModified FFmpeg with rogue RTSP servers
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>