---
id: CVE-2026-76763
title: >-
  Io.smallrye/smallrye-graphql: smallrye graphql: unauthenticated denial of
  service via large exponent float literals
summary: >-
  A flaw was found in SmallRye GraphQL. The number scalar coercion for
  BigInteger does not properly validate the magnitude of float or string inputs.
  An unauthenticated remote attacker can exploit this by sending a GraphQL query
  containing…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-1284
vendor: Red Hat
product: io.smallrye/smallrye-graphql
affected:
  - io.smallrye/smallrye-graphql (all versions)
  - io.smallrye/smallrye-graphql (all versions)
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-08-31T19:49:09.791654Z'
published: '2026-08-31'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T04:32:14.834Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-76763'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2026:62515'
    label: 'RHSA-2026:62515'
  - url: 'https://access.redhat.com/errata/RHSA-2026:62555'
    label: 'RHSA-2026:62555'
  - url: 'https://access.redhat.com/security/cve/CVE-2026-76763'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2519767'
    label: RHBZ#2519767
tags:
  - cve.org
epss: 0.00608
epssPercentile: 0.4807
ingestedAt: '2026-10-20T04:52:44.232Z'
---

## Overview

A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal. This can lead to the allocation of extremely large BigInteger objects, causing CPU exhaustion or an OutOfMemoryError, resulting in a denial of service.

## Affected

- `io.smallrye/smallrye-graphql (all versions)`
- `io.smallrye/smallrye-graphql (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

To mitigate this issue, applications exposing SmallRye GraphQL endpoints should implement validation and bounding of the precision or exponent for incoming numeric literals before they reach scalar coercion. Additionally, limiting the JVM heap size can help constrain the impact of OutOfMemoryError, though it will not prevent CPU exhaustion. Implementing rate-limiting or timeouts on the GraphQL endpoint can also reduce exposure. Using GraphQL variables instead of inline literals for numeric inputs is a safe alternative, as variables follow a secure parsing path.