https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T14:24:59.404721+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-354447 EUVD-2026-354447 2026-10-06T14:24:59.450545+00:00 EUVD-2026-354447 https://cve.radiocsirt.org/vuln/fkie_cve-2026-64868 fkie_cve-2026-64868 2026-10-06T14:24:59.450581+00:00

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.11, POST /api/stripe/webhook, POST /api/creem/webhook, and POST /api/waffo/webhook read and log full request bodies before signature validation in router/api-router.go and the payment controllers, allowing an unauthenticated attacker to cause memory pressure, container restarts, or disk exhaustion without forging a successful payment. This issue is fixed in version 1.0.0-rc.11.

 https://cve.radiocsirt.org/vuln/ghsa-v828-m3pf-vq9q GHSA-v828-m3pf-vq9q — New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging 2026-10-06T14:24:59.450615+00:00

Affected: Go: github.com/QuantumNous/new-api

## Summary

Unauthenticated payment webhook endpoints could read and log the entire request body before validating the webhook signature. When a payment webhook was enabled, an unauthenticated attacker could send oversized requests to public callback endpoints and force excessive memory use and log growth before the request was rejected.

Affected public endpoints included:

- `POST /api/stripe/webhook` - `POST /api/creem/webhook` - `POST /api/waffo/webhook`

This issue did not allow forging successful payments, because signature validation still guarded the payment processing logic. The vulnerable behavior was the expensive unauthenticated request processing that occurred before signature validation.

## Impact

A remote unauthenticated attacker could cause denial of service through memory pressure, container OOM/restarts, or disk consumption from full-body logging. The impact is availability-only and is rated High.

## Affected versions

Versions before `v1.0.0-rc.11` are affected. The earlier affected range of `<= v1.0.0-rc.7` was incomplete; the anonymous request body limit was introduced later and first appears in `v1.0.0-rc.11`.

## Patches

This issue is fixed in `v1.0.0-rc.11`. The fix adds `middleware.AnonymousRequestBodyLimit()` and applies it to unauthenticated POST routes, including the payment webhook callbacks. The default limit is controlled by `ANONYMOUS_REQUEST_BODY_LIMIT_KB` and defaults to 512 KiB.

## Workarounds

If upgrading immediately is not possible,…