CyberRota Analysis
AI-GeneratedThe vulnerability affects the New API's webhook endpoints, which improperly handle and log full request bodies before validating signatures, potentially allowing unauthenticated attackers to exploit this flaw. The impact includes causing memory pressure, container restarts, or disk exhaustion, which can disrupt service availability. Organizations using versions prior to 1.0.0-rc.11 should prioritize updating to the patched version to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.11, POST /api/stripe/webhook, POST /api/creem/webhook, and POST /api/waffo/webhook read and log full request bodies before signature validation in router/api-router.go and the payment controllers, allowing an unauthenticated attacker to cause memory pressure, container restarts, or disk exhaustion without forging a successful payment. This issue is fixed in version 1.0.0-rc.11.