Executive brief
New API is a Go-based platform for managing API quotas and billing. An integer overflow vulnerability in the quota calculation allows authenticated users with a positive account balance to submit a specially crafted request that triggers integer wraparound, resulting in a negative charge at settlement time—effectively crediting their account with large amounts of funds. If the platform offers free starting balances (via check-ins, referrals, or new-user gifts), attackers can obtain initial balance at no cost and then exploit this flaw at scale, draining the operator's prepaid upstream funds and disrupting billing and service availability.
Technical details
The vulnerability is an integer overflow flaw (CWE-190) in New API's quota billing system. Multiple billing code paths accept user-controlled quantity parameters (e.g., image multiplier `n`) and perform quota calculations like `int(float64(quota) * n)` without upper-bound validation or overflow-safe conversions. When a crafted extreme value (e.g., 18446744073686646784, a wrapped-negative when cast from uint) is multiplied into quota, the result wraps past the int64/int32 range into a large negative number. This negative quota is applied at settlement time (not at pre-consume request validation), effectively crediting the user's balance. Attack preconditions: the attacker must have an account with positive balance exceeding the un-inflated pre-consume cost; severity escalates if the deployment grants free starting balance (check-in rewards, referral bonuses, or new-user gifts), enabling near-unauthenticated mass exploitation. The flaw was actively exploited in the wild before patching. Fix: v1.0.0-rc.18 and later include upper-bound validation at ingress, local clamping on bypass paths, and saturating integer conversions in `common/quota_math.go`.
Affected products
- QuantumNous New API <= 1.0.0-rc.17
Timeline
- 2026-07-06: exploited: Community user reported in-the-wild exploitation with large negative consumption entries and abnormally inflated balances
- 2026-07-07: patched: Emergency fix released as v1.0.0-rc.18 approximately 2 hours after report
- 2026-07-07: disclosed: Public disclosure of vulnerability and fixed version to community; v1.0.0-rc.19 released with additional observability (quota-saturation warning logs)
- 2026-08-17: advisory: GitHub Security Advisory published