# CVE-2026-64868: QuantumNous new-api unauthenticated payment webhook denial of service

Source: https://junglewise.ai/threats/cve-2026-64868-quantumnous-new-api-unauthenticated-payment-webhook-denial-of  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-17. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-64868 · Severity: high · CVSS 7.5 · Published 2026-08-17

The New API application provides payment webhook endpoints for Stripe, Creem, and Waffo that process incoming payment notifications. An unauthenticated attacker can send oversized HTTP requests to these public endpoints, causing the application to read and log the full request body before validating the webhook signature. This forces excessive memory consumption and disk usage from logs, potentially crashing the application or filling storage, denying service to legitimate users.

Technologies: [github.com/QuantumNous/new-api (Go)](https://junglewise.ai/threats/technologies/github-com-quantumnous-new-api), [QuantumNous New API](https://junglewise.ai/threats/technologies/new-api). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [QuantumNous](https://junglewise.ai/threats/vendors/quantumnous).

## Quick answers

**Is CVE-2026-64868 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-64868 being exploited in the wild.

**How severe is CVE-2026-64868?** High severity, with a CVSS score of 7.5, published 17 August 2026.

**Which products and versions are affected?** github.com/QuantumNous/new-api (Go) < 1.0.0-rc.11, SEMVER:introduced=0,fixed=1.0.0-rc.11; QuantumNous New API < 1.0.0-rc.11.

**Is there a fix for CVE-2026-64868?** Yes. github.com/QuantumNous/new-api (Go): upgrade to 1.0.0-rc.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-64868 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-64868?** Check whether you run github.com/QuantumNous/new-api (Go) or QuantumNous New API at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/QuantumNous/new-api (Go): upgrade to 1.0.0-rc.11 or later

  ```sh
  go get github.com/QuantumNous/new-api@v1.0.0-rc.11
  ```


## Technical details

The vulnerability is a resource exhaustion issue (CWE-400, CWE-770) in the payment webhook handlers for Stripe, Creem, and Waffo. The root cause is that the application reads and logs the complete HTTP request body at the unauthenticated handler level before performing webhook signature validation. An attacker with network access to the public endpoints `/api/stripe/webhook`, `/api/creem/webhook`, or `/api/waffo/webhook` can send arbitrarily large POST requests without authentication. The application will consume memory buffering the entire body and generate voluminous log entries before rejecting the request during signature validation. This causes availability impact through memory exhaustion (container OOM kills) and disk exhaustion from log growth. The fix, released in v1.0.0-rc.11, adds middleware-level request body limits (default 512 KiB) to all unauthenticated POST routes, enforced before body reading. No signature forgery is possible since signature validation logic remains intact.

## Affected products

- QuantumNous new-api < 1.0.0-rc.11

## Identifiers

- CVE-2026-64868
- GHSA-v828-m3pf-vq9q
- GO-2026-6245

## Timeline

- 2026-08-17: disclosed: GitHub Advisory GHSA-v828-m3pf-vq9q published
- 2026-08-17: patched: Fix released in v1.0.0-rc.11

## References

- [https://api.github.com/users/passer12](https://api.github.com/users/passer12)
- [https://github.com/passer12](https://github.com/passer12)
- [https://api.github.com/users/passer12/gists%7B/gist_id%7D](https://api.github.com/users/passer12/gists%7B/gist_id%7D)
- [https://api.github.com/users/passer12/repos](https://api.github.com/users/passer12/repos)
- [https://avatars.githubusercontent.com/u/93042040?v=4](https://avatars.githubusercontent.com/u/93042040?v=4)
- [https://api.github.com/users/passer12/events%7B/privacy%7D](https://api.github.com/users/passer12/events%7B/privacy%7D)

## Related threats

- [QuantumNous new-api session expiration in Revoked API Token Handler](https://junglewise.ai/threats/cve-2026-82909-quantumnous-new-api-session-expiration-in-revoked-api-token)
- [QuantumNous New API integer overflow in quota billing](https://junglewise.ai/threats/cve-2026-71479-quantumnous-new-api-integer-overflow-in-quota-billing)
- [QuantumNous new-api admin passkey reset privilege escalation](https://junglewise.ai/threats/cve-2026-64866-quantumnous-new-api-admin-passkey-reset-privilege-escalation)
- [QuantumNous new-api Redis quota cache race condition in user settings update](https://junglewise.ai/threats/cve-2026-64865-quantumnous-new-api-redis-quota-cache-race-condition-in-user)
- [New API user list API information disclosure and privilege escalation](https://junglewise.ai/threats/cve-2026-64859-new-api-user-list-api-information-disclosure-and-privilege)