Description

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.11, POST /api/stripe/webhook, POST /api/creem/webhook, and POST /api/waffo/webhook read and log full request bodies before signature validation in router/api-router.go and the payment controllers, allowing an unauthenticated attacker to cause memory pressure, container restarts, or disk exhaustion without forging a successful payment. This issue is fixed in version 1.0.0-rc.11.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-17T16:17:22.713Z",
  "pubdate": "2026-08-17T16:17:22.713Z",
  "executiveSummary": "New API prior to version 1.0.0-rc.11 is affected by an unauthenticated denial of service vulnerability residing in its payment webhook processing endpoints. The vulnerability stems from improper handling of incoming HTTP POST requests where full request bodies are read and logged prior to cryptographic signature validation.\nAn unauthenticated remote attacker can exploit this weakness by submitting excessively large or continuous payloads to the affected webhook routes. This forces the application to allocate substantial memory resources and perform intensive disk I/O operations for logging before verifying the authenticity of the transaction.\nThe resulting impact includes severe memory pressure, application container crashes, and potential disk exhaustion, leading to a complete denial of service for the LLM gateway and AI asset management system. Exploitation requires no privileges, special configurations, or valid payment signatures, making it trivial to trigger over network exposures. Remediation requires upgrading the affected software to version 1.0.0-rc.11 or later, where signature validation precedes request body consumption and logging.",
  "technicalDetails": "The vulnerability exists within the payment webhook handling mechanism of New API, specifically impacting the POST /api/stripe/webhook, POST /api/creem/webhook, and POST /api/waffo/webhook endpoints managed via router/api-router.go and associated payment controllers.\nThe root cause of the vulnerability is an insecure architectural sequencing in the HTTP request processing pipeline. The application reads the entirety of the incoming HTTP request body into memory and writes raw payload data to system logs before executing any cryptographic signature verification or authenticity checks.\nThe attack flow proceeds as follows: First, an unauthenticated attacker targets one of the exposed webhook HTTP POST endpoints over the network. Second, the attacker transmits a specially crafted HTTP request containing an extraordinarily large payload or a high volume of concurrent requests. Third, router/api-router.go and the payment controllers intercept the request and immediately execute read and log operations on the raw body data without checking validation headers or signatures.\nBecause memory allocation and disk I/O occur unconditionally upon receipt of the payload, the application exhausts available heap space and system storage bandwidth. This unchecked resource consumption triggers memory pressure warnings, out-of-memory (OOM) killer terminations, application container restarts, or host disk exhaustion, effectively disrupting the availability of the AI asset management system.\nThe vulnerable component is the request processing logic within router/api-router.go and the payment controllers for Stripe, Creem, and Waffo integrations. Affected versions include all deployments prior to 1.0.0-rc.11. The vulnerability requires zero privileges and no authentication, exposing network-accessible instances to remote denial-of-service attacks."
}