No title provided

A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal. This can lead to the...

No title provided

A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal. This can lead to the...

CVE-2026-76763

A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal. This can lead to the...

CVE-2026-76763

A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal. This can lead to the...

EUVD-2026-68525

A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal. This can lead to the...

CVE-2026-76763 Io.smallrye/smallrye-graphql: smallrye graphql: unauthenticated denial of service via large exponent float literals

A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal. This can lead to the...

at.base3:sentry-quarkus-integration-tests (>=0.2.0, <=0.5.1), de.christophbrill.appframework:appframework (>=4.2.1, <=4.2.2) +18 more potentially affected by CVE-2026-76763 via io.smallrye:smallrye-graphql (>=2.18.0, <=2.18.4)

io.smallrye:smallrye-graphql MAVEN version =2.18.0, =0.2.0, =4.2.1, =0.53.0, =3.35.0.cr1, =3.35.0.cr1, =3.35.0.cr1, =2.18.0, =2.18.0, =2.18.0, =3.35.0, =3.39.0 - org.tasktide:api 0.9.0 and more Source cves: CVE-2026-76763 Source advisory: MEND:CVE-2026-76763...

com.github.t1:wunderbar.demo.order (3.5.1), com.github.t1:wunderbar.demo.product (3.5.1) +12 more potentially affected by CVE-2026-76763 via io.smallrye:smallrye-graphql (>=2.14.0, <=2.14.2)

io.smallrye:smallrye-graphql MAVEN version =2.14.0, =3.25.0.cr1, =3.25.0.cr1, =3.25.0.cr1, =2.14.0, =2.14.0, =2.14.0, =2.14.0, =2.14.0, =v0.46.0-rc1, =3.25.0, =0.11.0, =0.12.0 Source cves: CVE-2026-76763 Source advisory: MEND:CVE-2026-76763...

CVE-2026-76763

SmallRye GraphQL contains a flaw in its number scalar coercion for BigInteger , which fails to properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can send a GraphQL query containing a large exponent float literal, triggering the allocation of extremely l...

CVE-2026-76763 Io.smallrye/smallrye-graphql: smallrye graphql: unauthenticated denial of service via large exponent float literals

A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal. This can lead to the...

CVE-2026-76763

A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal. This can lead to the...

CVE-2026-76763: Improper Validation of Specified Quantity in Input

A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal. This can lead to the...

PT-2026-83837

Name of the Vulnerable Software and Affected Versions SmallRye GraphQL affected versions not specified Description An issue exists in the number scalar coercion for BigInteger that fails to properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit...

Authorization Bypass

quarkus-smallrye-graphql is vulnerable to Authorization Bypass. The vulnerability is due to doHandle function in SmallRyeGraphQLOverWebSocketHandler.java file there are no checks to ensure that the user is authenticated or authorized to access the GraphQL endpoint. This allows an attacker to acce...

com.github.t1:wunderbar.demo.product (>=3.0, <=3.2), io.github.chains-project:maven-lockfile-github-action (>=1.0.1, <=4.2.1) +21 more potentially affected by CVE-2023-6394 via io.quarkus:quarkus-smallrye-graphql-client (>=2.14.0.final, <=3.5.2)

io.quarkus:quarkus-smallrye-graphql-client MAVEN version =2.14.0.final, =3.0, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.15.2, =1.15.2, =1.15.2, =1.15.2, =1.15.2, =1.15.2, =1.15.2, =1.15.2, =1.15.2, =2.1.0 and more Source cves: CVE-2023-6394https://vu...

com.github.t1:wunderbar.demo.product (>=3.0, <=3.2), io.github.chains-project:maven-lockfile-github-action (>=1.0.1, <=4.2.1) +21 more potentially affected by CVE-2023-6394 via io.quarkus:quarkus-smallrye-graphql-client (>=2.14.0.final, <=3.5.2)

io.quarkus:quarkus-smallrye-graphql-client MAVEN version =2.14.0.final, =3.0, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.15.2, =1.15.2, =1.15.2, =1.15.2, =1.15.2, =1.15.2, =1.15.2, =1.15.2, =1.15.2, =2.1.0 and more Source cves: CVE-2023-6394https://vu...

com.github.t1:wunderbar.demo.product (>=2.2.0, <=2.4.9), io.quarkiverse.githubaction:quarkus-github-action (>=0.1.0, <=0.9.2) +19 more potentially affected by CVE-2023-6394 via io.quarkus:quarkus-smallrye-graphql-client (>=2.0.0.alpha3, <=2.13.8.final)

io.quarkus:quarkus-smallrye-graphql-client MAVEN version =2.0.0.alpha3, =2.2.0, =0.1.0, =0.1.0, =0.1.0, =1.3.0, =1.8.0, =1.8.0, =1.3.0, =1.3.0, =1.7.4, =1.8.0, =1.3.0, =1.3.0, =2.0.0, =2.0.0.alpha3, =2.13.8.final and more Source cves: CVE-2023-6394...

com.github.t1:wunderbar.demo.product (>=2.2.0, <=2.4.9), io.quarkiverse.githubaction:quarkus-github-action (>=0.1.0, <=0.9.2) +19 more potentially affected by CVE-2023-6394 via io.quarkus:quarkus-smallrye-graphql-client (>=2.0.0.alpha3, <=2.13.8.final)

io.quarkus:quarkus-smallrye-graphql-client MAVEN version =2.0.0.alpha3, =2.2.0, =0.1.0, =0.1.0, =0.1.0, =1.3.0, =1.8.0, =1.8.0, =1.3.0, =1.3.0, =1.7.4, =1.8.0, =1.3.0, =1.3.0, =2.0.0, =2.0.0.alpha3, =2.13.8.final and more Source cves: CVE-2023-6394...

com.github.t1:wunderbar.demo.product (>=2.2.0, <=2.4.9), io.quarkiverse.githubaction:quarkus-github-action (>=0.1.0, <=0.9.2) +19 more potentially affected by CVE-2023-6394 via io.quarkus:quarkus-smallrye-graphql-client (>=2.0.0.alpha3, <=2.13.8.final)

io.quarkus:quarkus-smallrye-graphql-client MAVEN version =2.0.0.alpha3, =2.2.0, =0.1.0, =0.1.0, =0.1.0, =1.3.0, =1.8.0, =1.8.0, =1.3.0, =1.3.0, =1.7.4, =1.8.0, =1.3.0, =1.3.0, =2.0.0, =2.0.0.alpha3, =2.13.8.final and more Source cves: CVE-2023-6394...

com.github.t1:wunderbar.demo.product (>=3.0, <=3.2), io.github.chains-project:maven-lockfile-github-action (>=1.0.1, <=4.2.1) +21 more potentially affected by CVE-2023-6394 via io.quarkus:quarkus-smallrye-graphql-client (>=2.14.0.final, <=3.5.2)

io.quarkus:quarkus-smallrye-graphql-client MAVEN version =2.14.0.final, =3.0, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.15.2, =1.15.2, =1.15.2, =1.15.2, =1.15.2, =1.15.2, =1.15.2, =1.15.2, =1.15.2, =2.1.0 and more Source cves: CVE-2023-6394https://vu...