CVE-2026-76763

Name of the Vulnerable Software and Affected Versions SmallRye GraphQL (affected versions not specified)

Description An issue exists in the number scalar coercion for BigInteger that fails to properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal. This leads to the allocation of extremely large BigInteger objects, causing CPU exhaustion or an OutOfMemoryError, which results in a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.