CVE-2026-15822

Summary

IBM DataPower Gateway suffers from improper memoization of GraphQL fragment spreads, which can lead to denial of service when a remote attacker sends specially crafted GraphQL requests. This vulnerability allows an attacker to cause the system to consume excessive resources or crash, disrupting service availability.

Exploitability

Exploitation appears straightforward as it requires sending malicious GraphQL requests over the network with specific fragment spread patterns, with no apparent preconditions for triggering the memory handling issue.

Blast radius

The impact could be significant across all affected DataPower Gateway versions, potentially causing widespread service disruption for organizations relying on GraphQL APIs managed by these gateways.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM DataPower Gateway 10.5.0.23, 10.6.7, 10.6.0.11, or 11.0.0.3 to address this denial of service vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.