SB2026092933 - Multiple vulnerabilities in IBM DataPower Gateway
Published: September 29, 2026 Updated: September 30, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Uncaught Exception (CVE-ID: CVE-2026-82417)
CWE-ID: CWE-248 - Uncaught Exception
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an uncaught exception in utils.isBuffer in qs.stringify when processing parsed query string data during a parse-to-stringify round-trip. A remote attacker can send a specially crafted query string to cause a denial of service.
The issue is reachable when qs.parse preserves constructor and isBuffer as own properties, such as with plainObjects: true or allowPrototypes: true.
2) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-82562)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in the qs parser when processing bracket-key comma-separated query string or form body input with comma: true. A remote attacker can supply a specially crafted parameter to cause a denial of service.
A single parameter can materialize an arbitrarily large array, and the issue occurs because bracket-key input can bypass configured arrayLimit and throwOnLimitExceeded checks.
3) Input validation error (CVE-ID: CVE-2026-2391)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due the arrayLimit option in qs does not enforce limits for comma-separated values when comma: true is enabled. A remote attacker can pass overly large string to the application and consume all available memory resources, leading to a denial of service condition.
Remediation
Install update from vendor's website.