AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Red HatCVE-2026-76763

Red Hat build of Quarkus: denial of service

Red Hat

CVE-2026-76763 · Published Aug 31, 2026 · updated Sep 1, 2026

High7.5
No fix yet
Red Hat advisory

A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal. This can lead to the allocation of extremely large BigInteger objects, causing CPU exhaustion or an OutOfMemoryError, resulting in a denial of service.

Affected versions

PackageAffectedFixed in
Red Hat build of Quarkus
Product
all versionsNo fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-1284

More Red Hat advisories

All Red Hat
Low 2.5Sep 1Red Hat popt. This vulnerability: memory corruptionCVE-2026-18743no fix yetHigh 8.8Aug 31Red Hat WebKitGTK: memory corruptionCVE-2026-83596no fix yetHigh 7.0Aug 31Red Hat GDB: out-of-bounds writeCVE-2026-13732no fix yetHigh 7.5Aug 31Red Hat build of Keycloak 26.6.7: XML external entityCVE-2026-17615no fix yetHigh 8.8Aug 31Red Hat Qute template engine: template injectionCVE-2026-12894fixed in 3.27.5.SP1 +1High 7.5Aug 31Red Hat build of Apache Camel for Spring Boot 4: resource exhaustionCVE-2026-81624no fix yet