CVE-2026-76763: Improper Validation of Specified Quantity in Input in Red Hat Red Hat build of Quarkus

This vulnerability in SmallRye GraphQL's number scalar coercion for BigInteger fails to properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal, leading to allocation of extremely large BigInteger objects. This results in CPU exhaustion or OutOfMemoryError, causing a denial of service. The parsing occurs before authorization and affects commonly used data types like Long or BigInteger. The vulnerability is rated with a CVSS 3.1 score of 7.5 (high severity) by Red Hat. No official fix or patch is currently confirmed. Red Hat advises implementing input validation and bounding of numeric literals, limiting JVM heap size, applying rate limiting or timeouts on GraphQL endpoints, and using GraphQL variables as mitigations.

The vulnerability allows unauthenticated remote attackers to cause denial of service by exhausting CPU resources or triggering OutOfMemoryError through crafted GraphQL queries with large exponent float literals. It impacts availability only, with no confidentiality or integrity loss reported. The parsing vulnerability occurs before authorization, increasing exposure risk.

No official patch or fix is currently confirmed by Red Hat. To mitigate this issue, applications exposing SmallRye GraphQL endpoints should implement validation and bounding of the precision or exponent for incoming numeric literals before scalar coercion. Limiting the JVM heap size can help constrain the impact of OutOfMemoryError but will not prevent CPU exhaustion. Additionally, applying rate-limiting or timeouts on the GraphQL endpoint can reduce exposure. Using GraphQL variables instead of inline literals for numeric inputs is a safe alternative, as variables follow a secure parsing path. Monitor the Red Hat advisory for updates on official fixes.