The QuantumNous new-api gateway is susceptible to a denial of service vulnerability, which could allow an unauthenticated attacker to exhaust system resources and render the service unavailable.

The application lacks sufficient limits or throttling mechanisms for resource allocation, leading to uncontrolled resource consumption (CWE-400 and CWE-770). This vulnerability is remotely exploitable by an unauthenticated attacker.

With a CVSS score of 7.5, this vulnerability represents a significant risk of service disruption. Successful exploitation allows an attacker to exhaust server resources, causing a denial of service that impacts business operations relying on the LLM gateway and AI asset management system.

Immediate Action: Update the QuantumNous new-api to version 1.0.0-rc.11 or later to implement necessary resource throttling and limits.

Proactive Monitoring: Monitor system resource usage, specifically CPU and memory metrics, for sudden spikes indicative of an exhaustion attack.

Compensating Controls: Implement rate limiting at the network or API gateway level to restrict the number of requests a single source can make to the new-api service.

Public Exploit Available: Unknown

Denial of service vulnerabilities in gateway components can cause widespread operational impact. Organizations should prioritize the update to version 1.0.0-rc.11 to ensure proper resource management and maintain service availability.