CVE-2026-71479: QuantumNous New API integer overflow in quota billing

CVE-2026-71479 · Severity: critical · CVSS 9.1 · Published 2026-08-17

New API is a Go-based platform for managing API quotas and billing. An integer overflow vulnerability in the quota calculation allows authenticated users with a positive account balance to submit a specially crafted request that triggers integer wraparound, resulting in a negative charge at settlement time—effectively crediting their account with large amounts of funds. If the platform offers free starting balances (via check-ins, referrals, or new-user gifts), attackers can obtain initial balance at no cost and then exploit this flaw at scale, draining the operator's prepaid upstream funds and disrupting billing and service availability.

Technologies: github.com/QuantumNous/new-api (Go), QuantumNous New API. Vendors: Go, QuantumNous.

Quick answers

Is CVE-2026-71479 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-71479 being exploited in the wild.
How severe is CVE-2026-71479?
Critical severity, with a CVSS score of 9.1, published 17 August 2026.
Which products and versions are affected?
github.com/QuantumNous/new-api (Go) <= 1.0.0-rc.17, SEMVER:introduced=0,fixed=1.0.0-rc.18; QuantumNous New API <= 1.0.0-rc.17.
Is there a fix for CVE-2026-71479?
Yes. github.com/QuantumNous/new-api (Go): upgrade to 1.0.0-rc.18 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71479 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-71479?
Check whether you run github.com/QuantumNous/new-api (Go) or QuantumNous New API at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/QuantumNous/new-api (Go): upgrade to 1.0.0-rc.18 or later
    go get github.com/QuantumNous/new-api@v1.0.0-rc.18

Technical details

The vulnerability is an integer overflow flaw (CWE-190) in New API's quota billing system. Multiple billing code paths accept user-controlled quantity parameters (e.g., image multiplier `n`) and perform quota calculations like `int(float64(quota) * n)` without upper-bound validation or overflow-safe conversions. When a crafted extreme value (e.g., 18446744073686646784, a wrapped-negative when cast from uint) is multiplied into quota, the result wraps past the int64/int32 range into a large negative number. This negative quota is applied at settlement time (not at pre-consume request validation), effectively crediting the user's balance. Attack preconditions: the attacker must have an account with positive balance exceeding the un-inflated pre-consume cost; severity escalates if the deployment grants free starting balance (check-in rewards, referral bonuses, or new-user gifts), enabling near-unauthenticated mass exploitation. The flaw was actively exploited in the wild before patching. Fix: v1.0.0-rc.18 and later include upper-bound validation at ingress, local clamping on bypass paths, and saturating integer conversions in `common/quota_math.go`.

Affected products

  • QuantumNous New API <= 1.0.0-rc.17

Identifiers

  • CVE-2026-71479
  • GHSA-8r8v-xf7q-rcpr
  • GO-2026-6242

Timeline

  • 2026-07-06: exploited: Community user reported in-the-wild exploitation with large negative consumption entries and abnormally inflated balances
  • 2026-07-07: patched: Emergency fix released as v1.0.0-rc.18 approximately 2 hours after report
  • 2026-07-07: disclosed: Public disclosure of vulnerability and fixed version to community; v1.0.0-rc.19 released with additional observability (quota-saturation warning logs)
  • 2026-08-17: advisory: GitHub Security Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.