EUVD-2026-60241
GHSA-v828-m3pf-vq9q
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated network-accessible endpoints with no complexity barrier; sole impact is availability via unbounded pre-validation resource consumption, with no confidentiality or integrity effect.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
4DescriptionCVE.org
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.11, POST /api/stripe/webhook, POST /api/creem/webhook, and POST /api/waffo/webhook read and log full request bodies before signature validation in router/api-router.go and the payment controllers, allowing an unauthenticated attacker to cause memory pressure, container restarts, or disk exhaustion without forging a successful payment. This issue is fixed in version 1.0.0-rc.11.
AnalysisAI
Unauthenticated denial-of-service in New API (QuantumNous), an open-source LLM gateway and AI asset management platform, allows remote attackers to exhaust host memory and disk resources by sending arbitrarily large payloads to payment webhook endpoints before any signature validation occurs. The payment processing routes for Stripe, Creem, and Waffo read and fully log request bodies prior to any cryptographic verification, meaning no valid payment credential or forged signature is required to trigger sustained resource consumption. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required beyond network reachability of the target instance - the affected endpoints (POST /api/stripe/webhook, POST /api/creem/webhook, POST /api/waffo/webhook) are intentionally unauthenticated, as they receive inbound callbacks from external payment processors. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H accurately reflects the threat: the attack requires no authentication, no user interaction, and presents low complexity over the network, making it trivially automatable. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade New API to version 1.0.0-rc.11 or later, which is the vendor-released patch confirmed by GitHub release tag v1.0.0-rc.11 (https://github.com/QuantumNous/new-api/releases/tag/v1.0.0-rc.11) and patch commit d2f7f9ee3adf3ef66798783a60d7bc712451c85c; this version introduces the AnonymousRequestBodyLimit middleware enforcing a 512 KB default cap on anonymous request bodies. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, implement network-level rate limiting and IP restrictions on payment webhook endpoints (Stripe, Creem, Waffo routes) to prevent external DoS attacks; additionally, deploy a Web Application Firewall rule to reject requests exceeding 512 KB to these endpoints. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today