# CVE-2026-71479: QuantumNous New API integer overflow in quota billing

Source: https://junglewise.ai/threats/cve-2026-71479-quantumnous-new-api-integer-overflow-in-quota-billing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-17. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-71479 · Severity: critical · CVSS 9.1 · Published 2026-08-17

New API is a Go-based platform for managing API quotas and billing. An integer overflow vulnerability in the quota calculation allows authenticated users with a positive account balance to submit a specially crafted request that triggers integer wraparound, resulting in a negative charge at settlement time—effectively crediting their account with large amounts of funds. If the platform offers free starting balances (via check-ins, referrals, or new-user gifts), attackers can obtain initial balance at no cost and then exploit this flaw at scale, draining the operator's prepaid upstream funds and disrupting billing and service availability.

Technologies: [github.com/QuantumNous/new-api (Go)](https://junglewise.ai/threats/technologies/github-com-quantumnous-new-api), [QuantumNous New API](https://junglewise.ai/threats/technologies/new-api). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [QuantumNous](https://junglewise.ai/threats/vendors/quantumnous).

## Quick answers

**Is CVE-2026-71479 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-71479 being exploited in the wild.

**How severe is CVE-2026-71479?** Critical severity, with a CVSS score of 9.1, published 17 August 2026.

**Which products and versions are affected?** github.com/QuantumNous/new-api (Go) <= 1.0.0-rc.17, SEMVER:introduced=0,fixed=1.0.0-rc.18; QuantumNous New API <= 1.0.0-rc.17.

**Is there a fix for CVE-2026-71479?** Yes. github.com/QuantumNous/new-api (Go): upgrade to 1.0.0-rc.18 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-71479 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-71479?** Check whether you run github.com/QuantumNous/new-api (Go) or QuantumNous New API at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/QuantumNous/new-api (Go): upgrade to 1.0.0-rc.18 or later

  ```sh
  go get github.com/QuantumNous/new-api@v1.0.0-rc.18
  ```


## Technical details

The vulnerability is an integer overflow flaw (CWE-190) in New API's quota billing system. Multiple billing code paths accept user-controlled quantity parameters (e.g., image multiplier `n`) and perform quota calculations like `int(float64(quota) * n)` without upper-bound validation or overflow-safe conversions. When a crafted extreme value (e.g., 18446744073686646784, a wrapped-negative when cast from uint) is multiplied into quota, the result wraps past the int64/int32 range into a large negative number. This negative quota is applied at settlement time (not at pre-consume request validation), effectively crediting the user's balance. Attack preconditions: the attacker must have an account with positive balance exceeding the un-inflated pre-consume cost; severity escalates if the deployment grants free starting balance (check-in rewards, referral bonuses, or new-user gifts), enabling near-unauthenticated mass exploitation. The flaw was actively exploited in the wild before patching. Fix: v1.0.0-rc.18 and later include upper-bound validation at ingress, local clamping on bypass paths, and saturating integer conversions in `common/quota_math.go`.

## Affected products

- QuantumNous New API <= 1.0.0-rc.17

## Identifiers

- CVE-2026-71479
- GHSA-8r8v-xf7q-rcpr
- GO-2026-6242

## Timeline

- 2026-07-06: exploited: Community user reported in-the-wild exploitation with large negative consumption entries and abnormally inflated balances
- 2026-07-07: patched: Emergency fix released as v1.0.0-rc.18 approximately 2 hours after report
- 2026-07-07: disclosed: Public disclosure of vulnerability and fixed version to community; v1.0.0-rc.19 released with additional observability (quota-saturation warning logs)
- 2026-08-17: advisory: GitHub Security Advisory published

## References

- [https://api.github.com/users/lihui12388](https://api.github.com/users/lihui12388)
- [https://github.com/lihui12388](https://github.com/lihui12388)
- [https://api.github.com/users/lihui12388/gists%7B/gist_id%7D](https://api.github.com/users/lihui12388/gists%7B/gist_id%7D)
- [https://api.github.com/users/lihui12388/repos](https://api.github.com/users/lihui12388/repos)
- [https://avatars.githubusercontent.com/u/32051199?v=4](https://avatars.githubusercontent.com/u/32051199?v=4)
- [https://api.github.com/users/lihui12388/events%7B/privacy%7D](https://api.github.com/users/lihui12388/events%7B/privacy%7D)

## Related threats

- [QuantumNous new-api session expiration in Revoked API Token Handler](https://junglewise.ai/threats/cve-2026-82909-quantumnous-new-api-session-expiration-in-revoked-api-token)
- [QuantumNous new-api unauthenticated payment webhook denial of service](https://junglewise.ai/threats/cve-2026-64868-quantumnous-new-api-unauthenticated-payment-webhook-denial-of)
- [QuantumNous new-api admin passkey reset privilege escalation](https://junglewise.ai/threats/cve-2026-64866-quantumnous-new-api-admin-passkey-reset-privilege-escalation)
- [QuantumNous new-api Redis quota cache race condition in user settings update](https://junglewise.ai/threats/cve-2026-64865-quantumnous-new-api-redis-quota-cache-race-condition-in-user)
- [New API user list API information disclosure and privilege escalation](https://junglewise.ai/threats/cve-2026-64859-new-api-user-list-api-information-disclosure-and-privilege)