CVE-2026-71479: New API: Integer overflow in quota billing yields negative charges (self-crediting)

Vulnerability summary

CVE-2026-71479 is a critical (CVSS 9.1) Integer Overflow or Wraparound vulnerability in quantumnous new-api. EPSS estimates a 0.65% chance of exploitation in the next 30 days, higher than 51% of scored vulnerabilities.

Timeline

1. 17-08-2026
   PublishedVulnerability first disclosed.
2. 17-08-2026
   Last modifiedVulnerability information updated.

Description

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.18, user-controlled image n, video seconds and duration, max_tokens, max_completion_tokens, maxOutputTokens, audio duration, and billing-expression quantities can overflow conversions in common/quota_math.go and related settlement paths, allowing a low-privileged account with positive balance or an active subscription to turn a negative charge into account credit and potentially drain upstream funds. This issue is fixed in version 1.0.0-rc.18.

• CWE-190Integer Overflow or WraparoundThe product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
• CWE-682Incorrect CalculationThe product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.