CVE-2026-76763

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-76763", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-08-19T16:58:05.744Z", "datePublished": "2026-08-31T13:54:18.490Z", "dateUpdated": "2026-10-20T04:32:14.834Z"}, "containers": {"cna": {"title": "Io.smallrye/smallrye-graphql: smallrye graphql: unauthenticated denial of service via large exponent float literals", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal. This can lead to the allocation of extremely large BigInteger objects, causing CPU exhaustion or an OutOfMemoryError, resulting in a denial of service."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat build of Quarkus 3.27.5.SP1", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "packageName": "io.smallrye/smallrye-graphql", "defaultStatus": "affected", "versions": [{"version": "2.14.2.redhat-00002", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:quarkus:3.27"]}, {"vendor": "Red Hat", "product": "Red Hat build of Quarkus 3.33.3.SP1", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "packageName": "io.smallrye/smallrye-graphql", "defaultStatus": "affected", "versions": [{"version": "2.17.0.redhat-00003", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:quarkus:3.33"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:62515", "name": "RHSA-2026:62515", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:62555", "name": "RHSA-2026:62555", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-76763", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2519767", "name": "RHBZ#2519767", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-08-31T11:58:30.899Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-1284", "description": "Improper Validation of Specified Quantity in Input", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-1284: Improper Validation of Specified Quantity in Input", "workarounds": [{"lang": "en", "value": "To mitigate this issue, applications exposing SmallRye GraphQL endpoints should implement validation and bounding of the precision or exponent for incoming numeric literals before they reach scalar coercion. Additionally, limiting the JVM heap size can help constrain the impact of OutOfMemoryError, though it will not prevent CPU exhaustion. Implementing rate-limiting or timeouts on the GraphQL endpoint can also reduce exposure. Using GraphQL variables instead of inline literals for numeric inputs is a safe alternative, as variables follow a secure parsing path."}], "timeline": [{"lang": "en", "time": "2026-08-19T16:46:42.274Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-08-31T11:58:30.899Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank Arpit Jain for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-10-20T04:32:14.834Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-31T19:49:09.791654Z", "id": "CVE-2026-76763", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-31T19:49:19.257Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-76763", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-31T19:49:09.791654Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-31T19:49:13.930Z"}}], "cna": {"title": "Io.smallrye/smallrye-graphql: smallrye graphql: unauthenticated denial of service via large exponent float literals", "credits": [{"lang": "en", "value": "Red Hat would like to thank Arpit Jain for reporting this issue."}], "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"cpes": ["cpe:/a:redhat:quarkus:3.27"], "vendor": "Red Hat", "product": "Red Hat build of Quarkus 3.27.5.SP1", "versions": [{"status": "unaffected", "version": "2.14.2.redhat-00002", "lessThan": "*", "versionType": "rpm"}], "packageName": "io.smallrye/smallrye-graphql", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:quarkus:3.33"], "vendor": "Red Hat", "product": "Red Hat build of Quarkus 3.33.3.SP1", "versions": [{"status": "unaffected", "version": "2.17.0.redhat-00003", "lessThan": "*", "versionType": "rpm"}], "packageName": "io.smallrye/smallrye-graphql", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-08-19T16:46:42.274Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-08-31T11:58:30.899Z", "value": "Made public."}], "datePublic": "2026-08-31T11:58:30.899Z", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:62515", "name": "RHSA-2026:62515", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:62555", "name": "RHSA-2026:62555", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-76763", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2519767", "name": "RHBZ#2519767", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "To mitigate this issue, applications exposing SmallRye GraphQL endpoints should implement validation and bounding of the precision or exponent for incoming numeric literals before they reach scalar coercion. Additionally, limiting the JVM heap size can help constrain the impact of OutOfMemoryError, though it will not prevent CPU exhaustion. Implementing rate-limiting or timeouts on the GraphQL endpoint can also reduce exposure. Using GraphQL variables instead of inline literals for numeric inputs is a safe alternative, as variables follow a secure parsing path."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal. This can lead to the allocation of extremely large BigInteger objects, causing CPU exhaustion or an OutOfMemoryError, resulting in a denial of service."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1284", "description": "Improper Validation of Specified Quantity in Input"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-10-20T04:32:14.834Z"}, "x_redhatCweChain": "CWE-1284: Improper Validation of Specified Quantity in Input"}}, "cveMetadata": {"cveId": "CVE-2026-76763", "state": "PUBLISHED", "dateUpdated": "2026-10-20T04:32:14.834Z", "dateReserved": "2026-08-19T16:58:05.744Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-08-31T13:54:18.490Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "cpes": ["cpe:/a:redhat:quarkus:3.27"], "defaultStatus": "affected", "packageName": "io.smallrye/smallrye-graphql", "product": "Red Hat build of Quarkus 3.27.5.SP1", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "2.14.2.redhat-00002", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "cpes": ["cpe:/a:redhat:quarkus:3.33"], "defaultStatus": "affected", "packageName": "io.smallrye/smallrye-graphql", "product": "Red Hat build of Quarkus 3.33.3.SP1", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "2.17.0.redhat-00003", "versionType": "rpm"}]}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal. This can lead to the allocation of extremely large BigInteger objects, causing CPU exhaustion or an OutOfMemoryError, resulting in a denial of service."}], "id": "CVE-2026-76763", "lastModified": "2026-10-20T05:16:55.003", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-76763", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-31T19:49:09.791654Z", "version": "2.0.3"}}]}, "published": "2026-08-31T14:17:23.050", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:62515"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:62555"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-76763"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2519767"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1284"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"acknowledgement": "Red Hat would like to thank Arpit Jain for reporting this issue.", "bugzilla": {"description": "io.smallrye/smallrye-graphql: SmallRye GraphQL: Unauthenticated Denial of Service via large exponent float literals", "id": "2519767", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2519767"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-1284", "details": ["A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal. This can lead to the allocation of extremely large BigInteger objects, causing CPU exhaustion or an OutOfMemoryError, resulting in a denial of service."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, applications exposing SmallRye GraphQL endpoints should implement validation and bounding of the precision or exponent for incoming numeric literals before they reach scalar coercion. Additionally, limiting the JVM heap size can help constrain the impact of OutOfMemoryError, though it will not prevent CPU exhaustion. Implementing rate-limiting or timeouts on the GraphQL endpoint can also reduce exposure. Using GraphQL variables instead of inline literals for numeric inputs is a safe alternative, as variables follow a secure parsing path."}, "name": "CVE-2026-76763", "package_state": [{"cpe": "cpe:/a:redhat:quarkus:3", "fix_state": "Affected", "package_name": "smallrye-graphql", "product_name": "Red Hat build of Quarkus"}], "public_date": "2026-08-31T11:58:30Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-76763\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-76763"], "statement": "This flaw is rated as Important. An unauthenticated remote attacker can trigger a denial of service by sending a crafted GraphQL query with a large exponent float literal to an application exposing a SmallRye GraphQL endpoint. This can lead to CPU exhaustion or an OutOfMemoryError, as the parsing occurs before authorization and affects commonly used data types like Long or BigInteger.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 98.0, "source": "matching"}]}, "original": {"product": "Red Hat build of Quarkus", "source": "cna", "vendor": "Red Hat"}, "product": "build_of_quarkus", "vendor": "redhat"}], "created": "2026-08-31T15:45:17.190660+00:00", "updated": "2026-08-31T16:00:05.781043+00:00", "vendors": ["redhat", "redhat$PRODUCT$build_of_quarkus"]}