The vulnerability allows an unauthenticated attacker to send arbitrary payloads to three webhook endpoints before the application verifies the payment signature. The unbounded read of the entire request body followed by full-body logging causes unlimited memory consumption and writes large data sets to disk. This can result in container restarts, memory pressure, or exhaustion of storage resources, effectively disabling the service for legitimate users.

QuantumNous New API, all releases before 1.0.0-rc.11. The affected endpoints are POST /api/stripe/webhook, POST /api/creem/webhook and POST /api/waffo/webhook. The product is a large language model gateway and AI asset management system that processes payment webhooks.

The CVSS score of 7.5 indicates a high severity vulnerability. EPSS is not available, but the lack of mitigation and the ability to trigger DoS remotely suggest a realistic exploitation risk. The vulnerability is not currently listed in the CISA KEV catalog. Attackers can target the webhook endpoints from the internet without authentication, making the exploitation path straightforward.