CVE-2026-14905
published 2026-10-08CVE-2026-14905: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to an XML…
PriorityP351high8.2CVSS 3.1
AVNACLPRNUINSUCHINAL
EPSS
0.34%
26.0th percentile
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | datapower_gateway | >= 10.5.0.0 < 10.5.0.23 | 10.5.0.23 |
| ibm | datapower_gateway | >= 10.6.0.0 < 10.6.0.11 | 10.6.0.11 |
| ibm | datapower_gateway | >= 10.6.1.0 < 11.0.0.3 | 11.0.0.3 |
| ibm | datapower_gateway | >= 11.0.0.0 < 11.0.0.3 | 11.0.0.3 |
| ibm | datapower_gateway_10.5.0 | 10.5.0.0 – 10.5.0.22 | — |
| ibm | datapower_gateway_10.6.0 | 10.6.0.0 – 10.6.0.10 | — |
| ibm | datapower_gateway_10.6cd | 10.6.1 – 10.6.6 | — |
| ibm | datapower_gateway_11.0.0 | 11.0.0.0 – 11.0.0.2 | — |
CVSS provenance
nvdv3.18.2HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
vendor_redhat7.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to an XML external entity injection (XXE) attack when p
ghsa_unreviewed·2026-10-08
CVE-2026-14905 [HIGH] CWE-611 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to an XML external entity injection (XXE) attack when p
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
Red Hat
389-ds-base: 389-ds-base: heap buffer overflow in schema objectclass serialization due to missing oc_superior in size calculation
vendor_redhat·2026-06-04·CVSS 7.2
CVE-2026-11884 [HIGH] CWE-122 389-ds-base: 389-ds-base: heap buffer overflow in schema objectclass serialization due to missing oc_superior in size calculation
389-ds-base: 389-ds-base: heap buffer overflow in schema objectclass serialization due to missing oc_superior in size calculation
A heap buffer overflow flaw was found in 389 Directory Server. When serializing objectclass definitions, the oc_superior (SUP) field length is omitted from buffer size calculations in read_schema_dse() and schema_oc_to_string(), but the field is still written via strcat(). An attacker with Directory Manager privileges, or a compromised replication supplier, can trigger a server crash by creating objectclasses with long SUP values. This is an incomplete fix variant of CVE-2025-14905.
Mitigation: Restrict Directory Manager access. Audit replication agreements. Monitor cn=schema modifications for unusually long SUP values. Restrict LDAP replication traffic to tru
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-11884 389-ds-base: 389-ds-base: heap buffer overflow in schema objectclass serialization due to missing oc_superior in size calculation [fedora-all]
bugzilla·2026-06-30·CVSS 7.2
CVE-2026-11884 [HIGH] CVE-2026-11884 389-ds-base: 389-ds-base: heap buffer overflow in schema objectclass serialization due to missing oc_superior in size calculation [fedora-all]
CVE-2026-11884 389-ds-base: 389-ds-base: heap buffer overflow in schema objectclass serialization due to missing oc_superior in size calculation [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Two heap buffer overflow vulnerabilities exist in 389 Directory Server schema serialization code. Both are incomplete-fix variants of CVE-2025-14905: the oc_superior (SUP) field length is omitted from buffer size calculations in read_schema_dse() and schema_oc_to_string(), but the field is still written via strcat().
Variant 1 (read_schema_dse, schema.c:1765): triggered during schema DSE reads; overflow at SUP >
Bugzilla
CVE-2026-11884 389-ds-base: 389-ds-base: heap buffer overflow in schema objectclass serialization due to missing oc_superior in size calculation
bugzilla·2026-06-04·CVSS 7.2
CVE-2026-11884 [HIGH] CVE-2026-11884 389-ds-base: 389-ds-base: heap buffer overflow in schema objectclass serialization due to missing oc_superior in size calculation
CVE-2026-11884 389-ds-base: 389-ds-base: heap buffer overflow in schema objectclass serialization due to missing oc_superior in size calculation
Two heap buffer overflow vulnerabilities exist in 389 Directory Server schema serialization code. Both are incomplete-fix variants of CVE-2025-14905: the oc_superior (SUP) field length is omitted from buffer size calculations in read_schema_dse() and schema_oc_to_string(), but the field is still written via strcat().
Variant 1 (read_schema_dse, schema.c:1765): triggered during schema DSE reads; overflow at SUP >= ~248 bytes.
Variant 2 (schema_oc_to_string, schema.c:5151): triggered during schema replication comparison; overflow at SUP >= ~62 bytes.
An attacker with Directory Manager privileges can crash the server. In replication topologies, a
2026-10-08
Published