A flaw in SmallRye GraphQL causes the BigInteger scalar coercion to accept float or string inputs without validating their magnitude. When an unauthenticated attacker submits a GraphQL query that contains a large exponent float literal, the server may attempt to allocate a huge BigInteger object, leading to excessive CPU consumption or an OutOfMemoryError. This results in a denial of service for the affected application.

The vulnerability impacts Red Hat’s build of Quarkus, specifically deployments that expose SmallRye GraphQL endpoints (the Red Hat Quarkus 3 package). No specific version range is identified beyond the inclusion of SmallRye GraphQL in the Quarkus environment.

The CVSS score of 7.5 indicates a high severity. Because the exploit is delivered over a GraphQL endpoint that is accessible from the network, a remote unauthenticated attacker could trigger the denial of service by simply sending a crafted query. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that public exploitation incidents are currently unknown. Nevertheless, the lack of a patch means the attack is possible in any exposed environment, and mitigation steps should be implemented promptly.