Description

A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal. This can lead to the allocation of extremely large BigInteger objects, causing CPU exhaustion or an OutOfMemoryError, resulting in a denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-31T14:17:23.050Z",
  "pubdate": "2026-08-31T14:17:23.050Z",
  "executiveSummary": "A critical vulnerability exists in the SmallRye GraphQL library concerning the improper validation of BigInteger scalar coercion.\nThe vulnerability is categorized as a Denial of Service (DoS) flaw caused by resource exhaustion.\nAn unauthenticated remote attacker can exploit this weakness by submitting specifically crafted GraphQL queries that include large exponent float literals.\nThe core issue involves the library failing to enforce magnitude limits on inputs intended for BigInteger coercion, which forces the JVM to allocate disproportionately large objects.\nThis behavior can lead to severe CPU spikes and OutOfMemoryError (OOM) conditions, effectively rendering the application unresponsive.\nThe risk is high due to the lack of required authentication or elevated privileges, allowing any remote user to trigger a resource exhaustion event.\nSystems integrating SmallRye GraphQL as a dependency are susceptible to this vector, posing a direct threat to service availability and system stability.",
  "technicalDetails": "The vulnerability resides within the scalar coercion logic of the SmallRye GraphQL library, specifically handling the BigInteger scalar type. When the library attempts to coerce incoming input—provided as either a floating-point literal or a string representation—into a BigInteger instance, it lacks rigorous input validation regarding the magnitude of the exponent.\nThe root cause of this flaw is the insecure processing of numerical inputs that are cast to arbitrary-precision BigInteger objects. In Java, the BigInteger class can represent integers of significant size, but the instantiation process for extremely large values consumes proportional CPU and heap memory. When an attacker supplies a float literal with an excessively large exponent (e.g., a number resulting in an immense value upon conversion), the library attempts to instantiate an object that exceeds standard processing capacity.\nThe attack flow begins with an unauthenticated attacker identifying a GraphQL endpoint powered by the vulnerable SmallRye GraphQL library. The attacker submits a malicious query containing a BigInteger field. Instead of providing a standard integer, the attacker injects a float literal or a specially formatted string with a massive exponent. The SmallRye GraphQL parser, upon reaching the coercion phase, does not validate the input range before passing it to the BigInteger constructor or conversion utility.\nAs the application processes the request, the underlying JVM initiates the allocation of memory to store the massive integer representation. This operation involves complex arithmetic calculations to handle the large scale, resulting in prolonged CPU usage. If the requested number is sufficiently large, the heap memory will be exhausted, triggering an OutOfMemoryError that crashes the thread or the entire application process, leading to a Denial of Service.\nThis vulnerability is particularly dangerous because it does not require authentication, allowing any entity with network access to the GraphQL API to initiate the attack. The lack of input size constraints or validation bounds on the scalar conversion function means that the vulnerability is exploitable via standard HTTP transport protocols used by the GraphQL interface. There are no privilege requirements, as the exploit is effective at the entry point of request processing, before authentication logic might typically be enforced."
}