CVE-2026-76763: Io.smallrye/smallrye-graphql: smallrye graphql: unauthenticated denial of service via large exponent float literals
A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal. This can lead to the allocation of extremely large BigInteger objects, causing CPU exhaustion or an OutOfMemoryError, resulting in a denial of service.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using SmallRye GraphQL that accept remote GraphQL queries are exposed. No authentication, user interaction, or special privileges are required for exploitation.
What does an attacker need to send to trigger the denial of service?
An attacker can send a GraphQL query containing a float literal with a large exponent. Improper coercion to BigInteger can then allocate an extremely large object and exhaust CPU resources or cause an OutOfMemoryError.
How can defenders determine whether an attack may be occurring?
Relevant indicators include GraphQL requests containing unusually large exponent float literals, followed by high CPU use, memory exhaustion, or OutOfMemoryError conditions in the affected service.