A flaw in the SmallRye GraphQL component used in Red Hat build of Quarkus allows unauthenticated attackers to cause a Denial of Service through resource exhaustion.

This vulnerability resides in the number scalar coercion logic for BigInteger within SmallRye GraphQL. An unauthenticated attacker can send a GraphQL query with a large exponent float literal, causing the application to allocate excessively large objects, leading to CPU exhaustion or OutOfMemoryError.

With a CVSS score of 7.5, this vulnerability represents a High severity risk primarily impacting system availability. Successful exploitation results in service disruption, which can lead to significant operational downtime for applications relying on the affected Quarkus builds.

Immediate Action: Consult the official Red Hat security advisory to identify patched versions and apply updates as soon as they are available.

Proactive Monitoring: Monitor system metrics, specifically CPU usage and memory consumption, for sudden spikes associated with GraphQL query processing.

Compensating Controls: Utilize a WAF or API gateway to limit the size and complexity of incoming GraphQL requests to prevent the processing of malicious payloads.

Public Exploit Available: Unknown.

Maintaining service availability is critical for production environments. Organizations should prioritize updating the affected Red Hat Quarkus builds once the vendor provides a resolution to eliminate the risk of Denial of Service attacks against GraphQL endpoints.