CVE-2026-76763

SmallRye GraphQL contains an input-validation flaw (CWE-1284) in its BigInteger number-scalar coercion: float and string inputs are converted to BigInteger without validating their magnitude. An unauthenticated remote attacker can trigger it by sending a GraphQL query containing a float literal with a very large exponent, causing the server to allocate extremely large BigInteger objects. The result is CPU exhaustion or an OutOfMemoryError, producing a denial of service; confidentiality and integrity are unaffected (CVSS 3.1 score 7.5, availability-only impact). Any service that exposes a GraphQL API built on SmallRye GraphQL — typically Quarkus applications using the smallrye-graphql extension or other runtimes embedding the library — is affected; the available data does not specify vulnerable or fixed version ranges. No public proof-of-concept, CISA KEV listing, or in-the-wild exploitation is currently known, and EPSS estimates only a ~0.4% probability of exploitation within 30 days.

What to do: Inventory deployments that expose a GraphQL endpoint built on SmallRye GraphQL (including the quarkus-smallrye-graphql extension) and upgrade to a patched SmallRye GraphQL release once the Red Hat/SmallRye advisory publishes fixed versions. Until patching, restrict or rate-limit unauthenticated access to GraphQL endpoints and monitor for OutOfMemoryError or unexplained CPU spikes in the JVM serving them.