REDHAT-BUG-2519767: High severity SmallRye GraphQL vulnerability
Published Aug 19, 2026
·Updated
A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal. This can lead to the allocation of extremely large BigInteger objects, causing CPU exhaustion or an OutOfMemoryError, resulting in a denial of service.
Affected Software
1 affected component
SmallRye GraphQL
Event History
Aug 19, 2026
Data Sourced
via Red Hat·05:00 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Does exploiting this issue require authentication?
No. The flaw can be triggered by an unauthenticated remote attacker through a GraphQL query that causes numeric input to be coerced to a BigInteger.