CVE-2026-64868
Received Received - Intake

API Memory Exhaustion in New API Gateway

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: GitHub, Inc.

Description
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.11, POST /api/stripe/webhook, POST /api/creem/webhook, and POST /api/waffo/webhook read and log full request bodies before signature validation in router/api-router.go and the payment controllers, allowing an unauthenticated attacker to cause memory pressure, container restarts, or disk exhaustion without forging a successful payment. This issue is fixed in version 1.0.0-rc.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-64868
EUVD
EUVD-2026-60241

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
quantumnous new-api to 1.0.0-rc.11 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves unauthenticated payment webhooks in New API versions before 1.0.0-rc.11. The system read and logged full request bodies before validating signatures, allowing attackers to send oversized requests. This caused memory pressure, container restarts, or disk exhaustion without payment forgery.

Detection Guidance

Monitor for unusually large request payloads to webhook endpoints or excessive memory/disk usage. Check logs for HTTP 413 errors indicating rejected oversized requests. Use tools like curl to test endpoint limits: curl -X POST -d @large_file.json http://target/api/stripe/webhook

Verify if your version is vulnerable by checking the software version. If using Docker, run: docker inspect <container> | grep Image. Affected versions are before 1.0.0-rc.11.

Impact Analysis

An attacker could exploit this to cause denial-of-service by consuming excessive memory or disk space. This may lead to service disruptions, application crashes, or system downtime. The impact is limited to availability loss as payment processing logic remained secure.

Compliance Impact

This vulnerability primarily impacts availability due to memory and disk exhaustion from oversized requests, which could lead to service disruptions. It does not directly affect data confidentiality or integrity, so standard compliance controls for GDPR or HIPAA may not be directly violated unless availability is a critical requirement for those frameworks.

Mitigation Strategies

Upgrade to version 1.0.0-rc.11 or later immediately. If upgrading is not possible, set ANONYMOUS_REQUEST_BODY_LIMIT_KB to 512 or lower in your environment. Disable unused webhooks and enforce body limits at a reverse proxy like Nginx or Apache.

Implement log rotation to prevent disk exhaustion. Monitor for abnormal traffic patterns targeting webhook endpoints. Consider temporarily disabling public webhook endpoints if not essential.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64868. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart