High severity · published Aug 31, 2026
CVE-2026-76763
Io.smallrye/smallrye-graphql: smallrye graphql: unauthenticated denial of service via large exponent float literals
7.5
CVSS
0.8%
EPSS
No
On KEV
Description
A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal. This can lead to the allocation of extremely large BigInteger objects, causing CPU exhaustion or an OutOfMemoryError, resulting in a denial of service.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat build of Quarkus 3.27.5.SP1 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat build of Quarkus 3.33.3.SP1 · Red Hat
All versions, or not specified · source: vendor
Affected product
RH
Red Hat build of Quarkus 3.27.5.SP1
Red Hat
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-76763
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-76763
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:62515
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:62555
access.redhat.com
https://access.redhat.com/security/cve/CVE-2026-76763
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2519767
More from Red Hat build of Quarkus 3.27.5.SP1
8.8
CVE-2026-12894
Io.quarkus:quarkus-qute: quarkus-qute:server-side template injection (ssti) vulnerability in reflectionvalueresolver of the quarkus qute template engine
7.5
CVE-2026-17615
Resteasy-core: resteasy sourceprovider remote unauthenticated file read