CVE-2026-71479
Received Received - Intake

API Quota Overflow in New API LLM Gateway

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: GitHub, Inc.

Description
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.18, user-controlled image n, video seconds and duration, max_tokens, max_completion_tokens, maxOutputTokens, audio duration, and billing-expression quantities can overflow conversions in common/quota_math.go and related settlement paths, allowing a low-privileged account with positive balance or an active subscription to turn a negative charge into account credit and potentially drain upstream funds. This issue is fixed in version 1.0.0-rc.18.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-71479
EUVD
EUVD-2026-60262

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
quantumnous new-api to 1.0.0-rc.18 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-190 The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
CWE-682 The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an integer overflow vulnerability in the billing system of the New API project. User-controlled parameters like image counts, video durations, and token limits could be manipulated to cause arithmetic overflows during quota calculations. This results in negative charges being applied to accounts, effectively converting them into large positive balances. The issue was fixed in version 1.0.0-rc.18 by adding validation and saturating conversions to prevent overflows.

Detection Guidance

Detecting this vulnerability requires checking for unusual billing behavior or negative quota values in logs. Look for requests with extreme parameter values (e.g., image counts > 128, video durations > 3600 seconds) or negative charges in settlement logs. Monitor for quota saturation warnings if using v1.0.0-rc.19 or later.

Impact Analysis

If exploited, this vulnerability allows an attacker with a low-privileged account to inflate their balance from a small positive amount to a very large one by causing negative charges. This could lead to financial losses for the service provider, potential depletion of upstream funds, and service unavailability. Exploitation requires an account with a positive balance, but features like sign-in rewards can remove this barrier.

Compliance Impact

This vulnerability primarily impacts billing integrity and financial compliance rather than direct data protection standards like GDPR or HIPAA. The flaw allows artificial account credits through integer overflow, which could lead to financial discrepancies and potential misuse of funds. While not directly violating GDPR or HIPAA, such billing integrity issues may indirectly affect compliance by undermining trust in financial record-keeping and audit trails required by these regulations.

Mitigation Strategies

Upgrade to version 1.0.0-rc.18 or later immediately. Audit logs for negative charges or unusual billing activity. Correct affected accounts by reversing fraudulent credits. Enable quota saturation warning logs if available. Monitor for signs of exploitation like extreme parameter values.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71479. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart