Is CVE-2026-64865 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-64865 being exploited in the wild.

How severe is CVE-2026-64865?

Medium severity, with a CVSS score of 4, published 17 August 2026.

Which products and versions are affected?

github.com/QuantumNous/new-api (Go) <= 1.0.0-rc.15, SEMVER:introduced=0,fixed=1.0.0-rc.16; QuantumNous New API <= 1.0.0-rc.15.

Is there a fix for CVE-2026-64865?

Yes. github.com/QuantumNous/new-api (Go): upgrade to 1.0.0-rc.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-64865 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-64865?

Check whether you run github.com/QuantumNous/new-api (Go) or QuantumNous New API at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-64865: QuantumNous new-api Redis quota cache race condition in user settings update

Q: Is there a fix for CVE-2026-64865?

Yes. github.com/QuantumNous/new-api (Go): upgrade to 1.0.0-rc.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-64865 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-64865?

Check whether you run github.com/QuantumNous/new-api (Go) or QuantumNous New API at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-64865 · Severity: medium · CVSS 4 · Published 2026-08-17

An authenticated user can bypass usage quota enforcement by repeatedly updating account settings (language or sidebar preferences) via the PUT /api/user/self endpoint. This race condition allows the user's cached quota balance to be artificially inflated, permitting API calls far beyond what they have paid for and causing direct financial loss to service operators.

Technologies: github.com/QuantumNous/new-api (Go), QuantumNous New API. Vendors: Go, QuantumNous.

Quick answers

Is CVE-2026-64865 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-64865 being exploited in the wild.
How severe is CVE-2026-64865?: Medium severity, with a CVSS score of 4, published 17 August 2026.
Which products and versions are affected?: github.com/QuantumNous/new-api (Go) <= 1.0.0-rc.15, SEMVER:introduced=0,fixed=1.0.0-rc.16; QuantumNous New API <= 1.0.0-rc.15.
Is there a fix for CVE-2026-64865?: Yes. github.com/QuantumNous/new-api (Go): upgrade to 1.0.0-rc.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-64865 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-64865?: Check whether you run github.com/QuantumNous/new-api (Go) or QuantumNous New API at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/QuantumNous/new-api (Go): upgrade to 1.0.0-rc.16 or later
```
go get github.com/QuantumNous/new-api@v1.0.0-rc.16
```

Technical details

This is a race condition (CWE-362) in the user quota caching layer. The vulnerable code path in controller/user.go's UpdateSelf function reads a full User object snapshot and writes it back through User.Update(), which includes stale quota data. The cache refresh via RedisHSetObj performs a full hash overwrite on the Redis user cache, including the Quota field. Meanwhile, normal billing operations atomically decrement quota using Redis HINCRBY commands. An attacker can race repeated PUT /api/user/self calls against quota consumption, causing stale Quota values to overwrite the decremented balance. The vulnerability requires authentication and a Redis-backed quota cache enabled, but no special privileges or user interaction. The fix in v1.0.0-rc.16 makes user setting updates field-scoped, prevents stale snapshots from overwriting accounting fields, and reserves quota cache updates for atomic quota delta or explicit synchronization paths.

Affected products

QuantumNous new-api <= 1.0.0-rc.15

Identifiers

CVE-2026-64865
GHSA-j6gc-4893-qwmp
GO-2026-6243

Timeline

2026-08-07: disclosed
2026-08-17: patched: Fixed in v1.0.0-rc.16

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.