A critical integer overflow vulnerability in the QuantumNous new-api gateway allows attackers to manipulate billing logic and potentially drain upstream funds.

This vulnerability resides in the common/quota_math.go file and related settlement paths. Due to improper input validation, user-controlled parameters such as token counts and durations can trigger integer overflows, allowing attackers to manipulate financial charges.

Successful exploitation of this flaw can lead to significant financial loss and unauthorized service consumption. By transforming negative charges into account credits, an attacker can effectively bypass payment requirements and deplete the organization's upstream AI service funds, potentially leading to service disruption and unexpected operational costs.

Immediate Action: Upgrade the QuantumNous new-api installation to version 1.0.0-rc.18 or later immediately.

Proactive Monitoring: Review system logs for unusual billing activity or requests containing anomalous values in token or duration fields.

Compensating Controls: Implement strict input validation at the Web Application Firewall (WAF) layer to block requests with suspiciously large or negative numerical parameters.

Public Exploit Available: No

This vulnerability presents a high risk to financial integrity and service availability. Administrators should prioritize the update to version 1.0.0-rc.18 to prevent potential financial abuse and ensure the stability of the AI gateway.