IBM DataPower Gateway wave (~36 GHSAs): pre-auth parser overflows on the perimeter SOA box¶

Wave in one line: pre-auth parser overflows on the perimeter SOA box, empty-password LDAP admin, and XML/signature trust legs

Source: hourly offensive-security scan of GitHub Security Advisories, 2026-10-08 (wave published 2026-10-08T15:33Z, ~36 GHSAs for IBM DataPower Gateway; affected bands 10.5.0.0–10.5.0.22, 10.6.0.0–10.6.0.10, 10.6.1–10.6.6, 11.0.0.0–11.0.0.2, some legs edition-gated).

One theme: DataPower is the archetypal untrusted-input-consuming perimeter appliance — it parses MIME/headers, XML, LDAP binds, and WS-Security material before any application auth runs — and this wave breaks each of those parsers and trust decisions independently. GHSA descriptions are IBM-secwizard-thin (buffer overflow / out-of-bounds write with no component detail); the durable operator value is the primitive ladder, the version bands, and the two legs that are fully described: the empty-password LDAP authentication bypass and the RFC2047 encoded-word parser overflow.

Advisory ladder (affected bands above; consult IBM support for per-CVE component detail)¶

Remaining wave legs (medium/high DoS/info-disclosure/memory items: [GHSA-45mg-85jf-3p6w], [GHSA-5j66-xmpm-rchf], [GHSA-xxwv-h449-cv3p], [GHSA-8cc9-pw6h-mjmm], [GHSA-27r3-8555-4mqr], [GHSA-9gh8-crxr-x3h2], [GHSA-gw8w-wvff-h76m], [GHSA-hrqg-vhp2-g4m3], [GHSA-mg5c-cfjv-p4c6], [GHSA-pc4p-jp58-fg79], [GHSA-qcmh-rwpx-c373], [GHSA-xg53-qqv9-r75w], [GHSA-w535-r5mv-2r4m], [GHSA-2ffc-9jmm-wqfj], [GHSA-3558-f8gc-mcgw], [GHSA-4f7f-cxgj-pvgm], [GHSA-x679-hw7m-3w5q], [GHSA-vv5f-9556-p73h], [GHSA-rhhx-8r9g-6xr9], [GHSA-m64c-924x-35gx], [GHSA-rqmf-29hf-rx8q], [GHSA-4qc5-wccj-3v7v], [GHSA-qpv3-q3xm-473g]) are the same parser/crypto/management-plane surface at lower severity — treat the full set as one fuzzing/recon map of the box, and pivot to IBM vendor advisories because the GHSA version fields and component names are empty (review-dump rule from the Oct 7 Cisco page applies verbatim).

Why this is an operator page¶

DataPower sits at the perimeter of banks, insurers, and telco SOA estates, typically with a small allowlist of inbound integrator traffic and an administrative WebUI/CLI behind it. DataPower has a documented history of targeted exploitation (previous KEV entries), and coordinated waves like this are where engagements find unpatched instances. Durable patterns:

1. Header/MIME encoders are pre-auth parser surface on API gateways. The RFC2047 encoded-word overflow proves the box parses =?charset?B?...?= constructs on a network path before auth. Reusable probe battery for any gateway/MTA-adjacent product (pair with the hMailServer page's mail-path fuzzing map): malformed encoded-words with (a) unterminated ?=, (b) oversized encoded sections, (c) nested/adjacent encoded-words, (d) bogus charset/encoding letters, (e) charset-driven width confusion (utf-16 with base64 payload), delivered in Subject:, Content-Type: parameters, and custom X-* headers through the gateway's Media Type/HTTP-headers processing. Crash-differential = reachable parser; never weaponize on production boxes.
2. Empty-password LDAP: the appliance that doesn't reject empty never asked the directory to say yes. The bypass works because DataPower handed an empty password to LDAP and the result was treated as authentication success — either the LDAP server permits empty-password binds (anonymous-style simple bind on some directory configs) or a policy gap lets empty through. Standing engagement test on any appliance federating to LDAP/AD: submit the login form / admin endpoint with a valid username and an empty password, and (where you control the lab directory) check ldapadd policies for empty-password acceptance. This is the empty-value-selects-permissive-branch family (389 DS SELFDN empty DN, Sept 7 page; Enswitch omitted reset param, same-day fold on the Sept 21 precedence page).
3. XXE on an XML appliance is the product's own reason to exist. A gateway built to validate/transform XML carrying an XXE leg means every XML-consuming front endpoint (SOAP proxies, DPML, style policies, xi:include-capable transforms) is a candidate. Standard canary discipline: lab DOCTYPE to owned callback, parameter-entity vs direct-entity differential, out-of-band via owned DNS; never exfil from production XML gateways.
4. Signature-validation legs on a WS-security gateway break the whole trust model. The improper-verification leg (authenticated) plus the WebUI XSS leg means signed-message trust and admin-session trust both fail on supported bands. Where you have a legitimately authenticated low-privilege account on an authorized test, verify whether signature enforcement can be bypassed on a policy that mandates it (wsu:Timestamp tamper matrix, per-policy vs global enforcement); treat any accept-with-bad-signature as a confirmed finding.
5. Edition/band-gated legs are fingerprints. The stored XSS is 10.6.0.x-only; the key-derivation DoS is 11.0-only; most legs span 10.5→11.0.0.2. On an authorized host, which specific leg reproduces (or banner/config clues, per the NetScaler per-CVE show-config gate rule on the Sept 15 KEV page) tells you the exact patch band — build a per-leg decision table before touching anything.
6. IBM coordinated waves = thin GHSAs; the vendor advisory is the real source. Empty component fields across ~30 items is the review-dump fingerprint (Oct 7 Cisco page rule): map each CVE to the IBM security bulletin for the affected feature (the feature name is the attack-surface name), and watch for KEV addition — DataPower legs with unauth RCE labels on an exploited-in-the-wild-historically product move fast (NetScaler 88779 was KEV'd <24h).

Validation boundaries¶

Authorized scope only; this page deliberately contains no payloads. Route/listener presence, version banner, and auth-gate evidence (empty-password decision table against a lab directory) are the safe first steps. Parser differential testing (RFC2047 battery, XXE canaries) requires lab DataPower or explicit customer sign-off with crash acceptance — a 9.8-class parser on a production SOA gateway can take down every service behind it. The local LPE and admin-path legs are lab-VM checks from an owned appliance shell only. Never test signature bypass or XSS against real admin sessions or live signing policies.

Sources: GHSA-7g2p-8chg-fgjv · GHSA-46h5-qc35-fvcx · GHSA-r865-p2h8-vpm8 · GHSA-jhg4-frpc-jp5v · GHSA-3m79-9w2v-h4h8 · GHSA-cmxx-hw22-cjvp · GHSA-3jq7-c3hf-9982 · GHSA-4cw5-qg45-7q65 · GHSA-9pvw-5fvv-vq8h · GHSA-8qgv-3jj6-w53r · IBM security advisories index