New API integer overflow turns $0.10 balance into $16.9 trillion

New API, a self-hosted OpenAI-compatible LLM gateway used to meter and bill access to upstream model providers, contained a critical quota-calculation flaw tracked as CVE-2026-71479. User-controlled quantity fields — image count, video duration, token limits — feed directly into billing math with no upper bound, letting a large enough value overflow New API's signed 64-bit integer and flip a charge into a credit.

The overflow only triggers at final settlement, after a small pre-charge check has already passed, so the request looks like an ordinary funded call right up until the balance inverts. Researchers reproduced the bug against the real product: a $0.10 account issued one dall-e-3 request with an inflated image count and ended up with a reported balance of $16,893,488,147,419.20, consistent with the product crossing the 2^63−1 signed-integer ceiling and wrapping negative.

The flaw was reported exploited in the wild on July 6, 2026, and the maintainer shipped an emergency fix, v1.0.0-rc.18, roughly two hours later. Rated CVSS 9.1 (Critical), it's a billing-integrity and availability issue rather than remote code execution or data exposure.

Public gateways with self-registration and free starting or referral credit enabled are especially exposed, since any account with even a tiny balance can pass the pre-charge gate. The fix in rc.18 clamps quantity fields (max 128 images, 3600-second duration cap) and routes quota math through saturating arithmetic. Operators should upgrade immediately, disable self-registration or free-balance grants until patched, and audit logs for negative-charge entries.