CVE-2026-76763 Overview
A flaw exists in SmallRye GraphQL where the number scalar coercion for BigInteger fails to validate the magnitude of float or string inputs. An unauthenticated remote attacker can send a GraphQL query containing a large exponent float literal to trigger allocation of extremely large BigInteger objects. The resulting CPU exhaustion or OutOfMemoryError produces a denial-of-service condition on the target service. The vulnerability is categorized under [CWE-1284] (Improper Validation of Specified Quantity in Input).
Critical Impact
Unauthenticated attackers can crash SmallRye GraphQL services with a single crafted query, causing resource exhaustion and service outages.
Affected Products
- SmallRye GraphQL (number scalar coercion for BigInteger)
- Red Hat products bundling the affected SmallRye GraphQL component
- Applications and frameworks that embed SmallRye GraphQL for query processing
Discovery Timeline
- 2026-08-31 - CVE-2026-76763 published to the National Vulnerability Database (NVD)
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-76763
Vulnerability Analysis
SmallRye GraphQL is a Jakarta implementation of the GraphQL specification used within Quarkus and other Java ecosystems. The library exposes scalar types including BigInteger for arbitrary-precision integer values. When coercing float or string inputs into BigInteger, the coercion path accepts values without bounding the numeric magnitude.
An attacker submits a GraphQL query containing a literal such as a floating-point value with a very large exponent. The coercion layer attempts to materialize the value as a BigInteger, allocating memory proportional to the magnitude of the input. This work is performed before authentication or business-logic checks, giving unauthenticated clients direct access to the vulnerable path.
Root Cause
The root cause is missing input validation on numeric magnitude during scalar coercion. The BigInteger coercion routine does not enforce an upper bound on the exponent or resulting bit length before allocation. A single request can therefore drive the JVM into sustained CPU work or exhaust the heap with an OutOfMemoryError.
Attack Vector
Exploitation requires network access to a GraphQL endpoint that exposes any field or argument typed as BigInteger. No authentication, privileges, or user interaction are required. The attacker sends a GraphQL query where a BigInteger-typed input carries a float literal with an extreme exponent, such as 1e2000000000, or a string that decodes to a similarly large value. The server allocates the corresponding BigInteger, consuming CPU and memory until the request fails or the JVM terminates.
No verified public proof-of-concept code is available. See the Red Hat CVE-2026-76763 Advisory and Red Hat Bug Report #2519767 for vendor technical details.
Detection Methods for CVE-2026-76763
Indicators of Compromise
- GraphQL query payloads containing float literals with unusually large exponents targeting BigInteger-typed arguments or variables.
- Repeated OutOfMemoryError entries or JVM garbage-collection storms correlated with inbound GraphQL traffic.
- Sudden CPU saturation on application nodes shortly after receipt of a small number of GraphQL requests.
Detection Strategies
- Inspect GraphQL request bodies at the API gateway or web application firewall for numeric literals exceeding a defined digit or exponent threshold.
- Alert on JVM heap-usage spikes and java.lang.OutOfMemoryError events emitted by services that expose SmallRye GraphQL endpoints.
- Correlate GraphQL query latency outliers with the specific fields or arguments typed as BigInteger in the schema.
Monitoring Recommendations
- Enable GraphQL query logging with argument capture for scalar types susceptible to coercion abuse.
- Track request-to-response byte ratios and per-request CPU time to surface algorithmic-complexity abuse patterns.
- Forward JVM metrics and application logs to a centralized analytics platform for retention and anomaly detection.
How to Mitigate CVE-2026-76763
Immediate Actions Required
- Apply vendor updates from Red Hat and any downstream distributor once available. Track the Red Hat CVE-2026-76763 Advisory for fixed package versions.
- Restrict network exposure of GraphQL endpoints to authenticated clients where business requirements allow.
- Enforce request size limits and query complexity limits at the API gateway to reduce the blast radius of malformed inputs.
Patch Information
Consult the Red Hat CVE-2026-76763 Advisory and Red Hat Bug Report #2519767 for fixed SmallRye GraphQL versions and affected Red Hat product streams. Upgrade to a patched release that validates the magnitude of float and string inputs during BigInteger coercion.
Workarounds
- Replace BigInteger-typed fields with bounded numeric types such as Int or Long in the GraphQL schema where feasible.
- Add a pre-parse filter or custom scalar coercion that rejects float literals exceeding a safe exponent and strings longer than a defined digit count.
- Configure per-request CPU and memory limits on the JVM and container runtime to contain the impact of a single abusive query.
# Example gateway rule: reject GraphQL payloads containing oversized numeric literals
# (pseudocode for a WAF or reverse proxy; adapt to your environment)
if request.path == "/graphql" and request.body matches /[0-9]+(\.[0-9]+)?[eE][+-]?[0-9]{6,}/:
return 400 "Numeric literal exceeds allowed exponent"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
