CVE-2026-76763: Io.smallrye/smallrye-graphql: smallrye graphql: unauthenticated denial of service via large exponent float literals

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-31 · updated 2026-10-20
Weakness: CWE-1284

Description

A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal. This can lead to the allocation of extremely large BigInteger objects, causing CPU exhaustion or an OutOfMemoryError, resulting in a denial of service.

Affected products

Red Hat build of Quarkus 3.27.5.SP1: all versions — fixed in 2.14.2.redhat-00002
Red Hat build of Quarkus 3.33.3.SP1: all versions — fixed in 2.17.0.redhat-00003

How to fix

Upgrade to a fixed version: Red Hat build of Quarkus 3.27.5.SP1 2.14.2.redhat-00002; Red Hat build of Quarkus 3.33.3.SP1 2.17.0.redhat-00003. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-76763 or the next vulnerability affects your stack