Vulnerability-Lookup

GHSA-V828-M3PF-VQ9Q

Vulnerability from github – Published: 2026-08-17 16:35 – Updated: 2026-08-17 16:35

Summary

New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging

Details

Summary

Unauthenticated payment webhook endpoints could read and log the entire request body before validating the webhook signature. When a payment webhook was enabled, an unauthenticated attacker could send oversized requests to public callback endpoints and force excessive memory use and log growth before the request was rejected.

Affected public endpoints included:

POST /api/stripe/webhook
POST /api/creem/webhook
POST /api/waffo/webhook

This issue did not allow forging successful payments, because signature validation still guarded the payment processing logic. The vulnerable behavior was the expensive unauthenticated request processing that occurred before signature validation.

Impact

A remote unauthenticated attacker could cause denial of service through memory pressure, container OOM/restarts, or disk consumption from full-body logging. The impact is availability-only and is rated High.

Affected versions

Versions before v1.0.0-rc.11 are affected. The earlier affected range of <= v1.0.0-rc.7 was incomplete; the anonymous request body limit was introduced later and first appears in v1.0.0-rc.11.

Patches

This issue is fixed in v1.0.0-rc.11. The fix adds middleware.AnonymousRequestBodyLimit() and applies it to unauthenticated POST routes, including the payment webhook callbacks. The default limit is controlled by ANONYMOUS_REQUEST_BODY_LIMIT_KB and defaults to 512 KiB.

Workarounds

If upgrading immediately is not possible, operators should disable unused payment webhooks, enforce request body limits at a reverse proxy or load balancer, and ensure application and container logs have rotation and quotas. These mitigations reduce exposure but do not replace upgrading.

References

Fixed by commit d2f7f9ee3adf3ef66798783a60d7bc712451c85c.
Relevant code paths: router/api-router.go, middleware/request_body_limit.go, controller/topup_stripe.go, controller/topup_creem.go, and controller/topup_waffo.go.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/QuantumNous/new-api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.0-rc.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-64868"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400",
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-17T16:35:58Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nUnauthenticated payment webhook endpoints could read and log the entire request body before validating the webhook signature. When a payment webhook was enabled, an unauthenticated attacker could send oversized requests to public callback endpoints and force excessive memory use and log growth before the request was rejected.\n\nAffected public endpoints included:\n\n- `POST /api/stripe/webhook`\n- `POST /api/creem/webhook`\n- `POST /api/waffo/webhook`\n\nThis issue did not allow forging successful payments, because signature validation still guarded the payment processing logic. The vulnerable behavior was the expensive unauthenticated request processing that occurred before signature validation.\n\n## Impact\n\nA remote unauthenticated attacker could cause denial of service through memory pressure, container OOM/restarts, or disk consumption from full-body logging. The impact is availability-only and is rated High.\n\n## Affected versions\n\nVersions before `v1.0.0-rc.11` are affected. The earlier affected range of `\u003c= v1.0.0-rc.7` was incomplete; the anonymous request body limit was introduced later and first appears in `v1.0.0-rc.11`.\n\n## Patches\n\nThis issue is fixed in `v1.0.0-rc.11`. The fix adds `middleware.AnonymousRequestBodyLimit()` and applies it to unauthenticated POST routes, including the payment webhook callbacks. The default limit is controlled by `ANONYMOUS_REQUEST_BODY_LIMIT_KB` and defaults to 512 KiB.\n\n## Workarounds\n\nIf upgrading immediately is not possible, operators should disable unused payment webhooks, enforce request body limits at a reverse proxy or load balancer, and ensure application and container logs have rotation and quotas. These mitigations reduce exposure but do not replace upgrading.\n\n## References\n\n- Fixed by commit `d2f7f9ee3adf3ef66798783a60d7bc712451c85c`.\n- Relevant code paths: `router/api-router.go`, `middleware/request_body_limit.go`, `controller/topup_stripe.go`, `controller/topup_creem.go`, and `controller/topup_waffo.go`.",
  "id": "GHSA-v828-m3pf-vq9q",
  "modified": "2026-08-17T16:35:58Z",
  "published": "2026-08-17T16:35:58Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/QuantumNous/new-api/security/advisories/GHSA-v828-m3pf-vq9q"
    },
    {
      "type": "WEB",
      "url": "https://github.com/QuantumNous/new-api/pull/5244"
    },
    {
      "type": "WEB",
      "url": "https://github.com/QuantumNous/new-api/commit/d2f7f9ee3adf3ef66798783a60d7bc712451c85c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/QuantumNous/new-api"
    },
    {
      "type": "WEB",
      "url": "https://github.com/QuantumNous/new-api/releases/tag/v1.0.0-rc.11"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging"
}

CVE-2026-64868 (GCVE-0-2026-64868)

Vulnerability from cvelistv5 – Published: 2026-08-17 15:44 – Updated: 2026-08-17 16:31

Title

New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging

Summary

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.11, POST /api/stripe/webhook, POST /api/creem/webhook, and POST /api/waffo/webhook read and log full request bodies before signature validation in router/api-router.go and the payment controllers, allowing an unauthenticated attacker to cause memory pressure, container restarts, or disk exhaustion without forging a successful payment. This issue is fixed in version 1.0.0-rc.11.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-17 16:30 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption
CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/QuantumNous/new-api/security/a…	x_refsource_CONFIRM
https://github.com/QuantumNous/new-api/pull/5244	x_refsource_MISC
https://github.com/QuantumNous/new-api/commit/d2f…	x_refsource_MISC
https://github.com/QuantumNous/new-api/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
QuantumNous	new-api	Affected: < 1.0.0-rc.11

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-64868",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-17T16:30:03.088827Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-17T16:31:08.189Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "new-api",
          "vendor": "QuantumNous",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.0-rc.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.11, POST /api/stripe/webhook, POST /api/creem/webhook, and POST /api/waffo/webhook read and log full request bodies before signature validation in router/api-router.go and the payment controllers, allowing an unauthenticated attacker to cause memory pressure, container restarts, or disk exhaustion without forging a successful payment. This issue is fixed in version 1.0.0-rc.11."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T15:44:14.137Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/QuantumNous/new-api/security/advisories/GHSA-v828-m3pf-vq9q",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/QuantumNous/new-api/security/advisories/GHSA-v828-m3pf-vq9q"
        },
        {
          "name": "https://github.com/QuantumNous/new-api/pull/5244",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/QuantumNous/new-api/pull/5244"
        },
        {
          "name": "https://github.com/QuantumNous/new-api/commit/d2f7f9ee3adf3ef66798783a60d7bc712451c85c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/QuantumNous/new-api/commit/d2f7f9ee3adf3ef66798783a60d7bc712451c85c"
        },
        {
          "name": "https://github.com/QuantumNous/new-api/releases/tag/v1.0.0-rc.11",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/QuantumNous/new-api/releases/tag/v1.0.0-rc.11"
        }
      ],
      "source": {
        "advisory": "GHSA-v828-m3pf-vq9q",
        "discovery": "UNKNOWN"
      },
      "title": "New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-64868",
    "datePublished": "2026-08-17T15:44:14.137Z",
    "dateReserved": "2026-07-20T18:31:39.292Z",
    "dateUpdated": "2026-08-17T16:31:08.189Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-V828-M3PF-VQ9Q

Summary

Impact

Affected versions

Patches

Workarounds

References

CVE-2026-64868 (GCVE-0-2026-64868)

Tags

Sightings

Nomenclature