CVE-2026-71479

Name of the Vulnerable Software and Affected Versions New API versions prior to 1.0.0-rc.18

Description An issue exists where user-controlled quantity parameters can cause overflow conversions during quota calculations in common/quota math.go and related settlement paths. A low-privileged account with a positive balance or active subscription can provide extreme values for specific parameters to turn a negative charge into account credit, potentially draining upstream funds. This occurs because multipliers lack upper-bound validation and float-to-int conversions lack saturation, allowing values to wrap into a large negative quota during settlement. This issue has been confirmed as exploited in the wild.

Vulnerable Parameters or Variables: n (image quantity), seconds (video), duration (video/audio), max tokens, max completion tokens, maxOutputTokens, and billing-expression quantities.

Recommendations Update New API to version 1.0.0-rc.18 or later. As a temporary mitigation, restrict the use of the n, seconds, duration, max tokens, max completion tokens, maxOutputTokens, and billing-expression parameters to known safe ranges.