PT-2026-76685 · Go+3 · Github.Com/Quantumnous/New-Api+2
CVE-2026-64868
·
Published
2026-08-17
·
Updated
2026-09-04
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
New API versions prior to 1.0.0-rc.11
Description
Unauthenticated payment webhook endpoints read and log full request bodies before performing signature validation. This occurs in
router/api-router.go and the payment controllers. An unauthenticated attacker can send oversized requests to the following endpoints to cause memory pressure, container restarts (Out of Memory), or disk exhaustion due to excessive log growth:- "POST /api/stripe/webhook"
- "POST /api/creem/webhook"
- "POST /api/waffo/webhook"
Recommendations
Update to version 1.0.0-rc.11.
Disable unused payment webhooks.
Enforce request body limits at a reverse proxy or load balancer.
Ensure application and container logs have rotation and quotas.
Exploit
Fix
DoS
Resource Exhaustion
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Github.Com/Quantumnous/New-Api
Govulncheck-Vulndb
New Api