{"action":"Upgrade github.com/QuantumNous/new-api to 1.0.0-rc.11 or later.","affected":[{"fixed":"1.0.0-rc.11","introduced":"0"}],"component":"github.com/QuantumNous/new-api","cve_ids":["CVE-2026-64868"],"ecosystem":"Go","epss":0.00639,"exploited":false,"fixed_versions":["1.0.0-rc.11"],"ghsa_id":"GHSA-v828-m3pf-vq9q","id":"tcs_01M5KGSNVXCFP3DT6FRNH781BN","modified_at":"2026-08-18T15:00:25.645059708Z","published_at":"2026-08-18T14:32:29Z","references":["https://osv.dev/vulnerability/GO-2026-6245","https://github.com/QuantumNous/new-api/security/advisories/GHSA-v828-m3pf-vq9q","https://github.com/QuantumNous/new-api/commit/d2f7f9ee3adf3ef66798783a60d7bc712451c85c","https://github.com/QuantumNous/new-api/pull/5244","https://github.com/QuantumNous/new-api/releases/tag/v1.0.0-rc.11"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-6245","url":"https://osv.dev/vulnerability/GO-2026-6245"}],"summary":"New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api"}