Answer in brief
CVE-2026-64865 records a Medium severity vulnerability in New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass. The current sources do not mark it as known exploited. The current feed maps QuantumNous/new-api (generic), github.com/QuantumNous/new-api (go), github.com/QuantumNous/new-api (go). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
Answer in brief
CVE-2026-64865 records a Medium severity vulnerability in New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass. The current sources do not mark it as known exploited. The current feed maps QuantumNous/new-api (generic), github.com/QuantumNous/new-api (go), github.com/QuantumNous/new-api (go). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps QuantumNous/new-api (generic), github.com/QuantumNous/new-api (go), github.com/QuantumNous/new-api (go). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| QuantumNous/new-apigeneric | < 1.0.0-rc.16 | Not reported |
| github.com/QuantumNous/new-apigo | >=0 <1.0.0-rc.16 | 1.0.0-rc.16 |
| github.com/QuantumNous/new-apigo | <=1.0.0-rc.15 | 1.0.0-rc.16 |
Published upstream
Aug 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 17, 2026
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.16, repeated PUT /api/user/self requests that update language or sidebar_modules can race relay billing because controller/user.go calls User.Update and updateUserCache performs a full RedisHSetObj write to user:.Quota, overwriting concurrent HINCRBY deductions and allowing an authenticated user to keep cached quota artificially high. This issue is fixed in version 1.0.0-rc.16.
Quoted source text, attributed separately from HOL analysis.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps QuantumNous/new-api (generic), github.com/QuantumNous/new-api (go), github.com/QuantumNous/new-api (go). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| QuantumNous/new-apigeneric | < 1.0.0-rc.16 | Not reported |
| github.com/QuantumNous/new-apigo | >=0 <1.0.0-rc.16 | 1.0.0-rc.16 |
| github.com/QuantumNous/new-apigo | <=1.0.0-rc.15 | 1.0.0-rc.16 |
Published upstream
Aug 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 17, 2026
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.16, repeated PUT /api/user/self requests that update language or sidebar_modules can race relay billing because controller/user.go calls User.Update and updateUserCache performs a full RedisHSetObj write to user:.Quota, overwriting concurrent HINCRBY deductions and allowing an authenticated user to keep cached quota artificially high. This issue is fixed in version 1.0.0-rc.16.
Quoted source text, attributed separately from HOL analysis.