What is CVE-2026-71479?

CVE-2026-71479 is a critical-severity vulnerability in Quantumnous New-Api, classified under Integer Overflow or Wraparound. CVSS score: 9.1/10. Published 2026-08-17.

How severe is CVE-2026-71479?

Critical severity. CVSS v3 base score is 9.1 out of 10.

Integer overflow in Quantumnous New-Api

CVE-2026-71479

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.18, user-controlled image n, video seconds and duration, max_tokens, max_completion_tokens, maxOutputTokens, audio duration, and billing-expression quantities can overflow conversions in common/quota_math.go and related settlement paths, allowing a low-privileged account with positive balance or an active subscription to turn a negative charge into account credit and potentially drain upstream funds. This issue is fixed in version 1.0.0-rc.18.

Vulnerability class: Integer Overflow

Published 2026-08-17 · last modified 2026-09-18.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H.

EPSS exploit prediction

EPSS: 0.006 (49.2th percentile), scored 2026-10-03.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 49th percentile — 49.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.005 · newest: 0.006 · change: +0.001

Affected products

Quantumnous New-Api — versions < 1.0.0-rc.18

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-71479?: CVE-2026-71479 is a critical-severity vulnerability in Quantumnous New-Api, classified under Integer Overflow or Wraparound. CVSS score: 9.1/10. Published 2026-08-17.
How severe is CVE-2026-71479?: Critical severity. CVSS v3 base score is 9.1 out of 10.