critical · 9.1CVE-2026-71479Aug 17, 2026

CVE-2026-71479: new-api Integer Overflow in Quota Billing Yields Negative Charges

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

A crafted image-generation request with a near-maxint quantity value causes new-api's billing math to wrap into a large negative number at settlement, crediting the attacker's balance instead of…

Packagegithub.com/QuantumNous/new-api
Ecosystemgo
Affected<= 1.0.0-rc.17
Fixed in1.0.0-rc.18
CVE-2026-71479: new-api Integer Overflow in Quota Billing Yields Negative Charges

The problem

In new-api <= 1.0.0-rc.17, several billing paths multiply a user-controlled quantity parameter (e.g. the image n field) into a quota value with no upper-bound check. The *uint JSON field accepts any positive integer, including values that are a wrapped negative such as 18446744073686646784.

At settlement, the expression int(float64(quota) * n) overflows int64/int32 and produces a large negative quota. A negative settlement is treated as a credit, so the attacker's balance grows instead of shrinking. The pre-consume gate (which rejects zero or negative balance) never sees the multiplier, so it cannot block this path.

Proof of concept

A working proof-of-concept for CVE-2026-71479 in github.com/QuantumNous/new-api, with the exact payload below.

http
POST /v1/images/generations HTTP/1.1
Host: <target>
Authorization: Bearer <valid-api-key>
Content-Type: application/json

{
  "model": "dall-e-3",
  "prompt": "a cat",
  "n": 18446744073686646784,
  "size": "1024x1024"
}

The n field is typed as *uint in the request struct, so JSON unmarshalling accepts the value 18446744073686646784 (which is 2^64 - 10000000000000000, a near-max uint64) without error. When settlement computes int(float64(quota) * float64(n)), the product exceeds int64 max and wraps to a large negative integer.

Because negative quota means the server owes the user tokens, the DB write credits the balance.

The patch (commits c9943d3 and d0bd8aa) applies three layers of defense: an upper-bound validator at request ingress that returns HTTP 400 on oversized n, local clamping on passthrough/metadata paths that bypass the validator, and a new common/quota_math.go module with saturating int32 conversions that clamp instead of wrapping.

CWE-190 (Integer Overflow) and CWE-682 (Incorrect Calculation) both apply.

The fix

Upgrade to new-api v1.0.0-rc.18 or later (v1.0.0-rc.19 adds quota-saturation audit logs for post-incident review). After upgrading, audit your consume/task logs for entries where admin_info.quota_saturation is set or where settlement quota is negative; those indicate prior exploitation.

Also review whether your deployment has check-in rewards, invite rebates, or new-user quota gifts enabled, as those features lower the attacker's cost to obtain the required seed balance to near zero.

Reported by lihui12388.

References: [1][2][3][4][5]

Related research