CVE-2026-76763
High
Description
A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal. This can lead to the allocation of extremely large BigInteger objects, causing CPU exhaustion or an OutOfMemoryError, resulting in a denial of service.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Red Hat build of Quarkus 3.27.5.SP1
PublishedAug 31, 2026
First seenAug 31, 2026
Weakness typeCWE-1284CWE-1284
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Red Hat build of Quarkus 3.27.5.SP1 | No range specified | — |
| Red Hat Red Hat build of Quarkus 3.33.3.SP1 | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.