Log in Start free

Vulnerability · Published Aug 31, 2026 · Assigned by redhat

CVE-2026-76763Io.smallrye/smallrye-graphql: smallrye graphql: unauthenticated denial of service via large exponent float literals

High 7.5

In plain English

A high-severity security flaw in Red Hat build of Quarkus 3.27.5.SP1 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.8%top 43.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal. This can lead to the allocation of extremely large BigInteger objects, causing CPU exhaustion or an OutOfMemoryError, resulting in a denial of service.

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat build of Quarkus 3.27.5.SP1 see references
Red Hat Red Hat build of Quarkus 3.33.3.SP1 see references

Weakness: CWE-1284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References