CVE-2026-106676 Details
Description
qiujie mall-server 0.0.1-SNAPSHOT contains an integer overflow in CartServiceImpl that allows an authenticated user to wrap a cart quantity to a negative value. The order creation flow does not validate the resulting quantity and passes it to the stock update query, increasing inventory and creating negative-value orders.
An integer overflow vulnerability has been identified in qiujie mall-server version 0.0.1-SNAPSHOT, specifically within the CartServiceImpl. This vulnerability allows an authenticated user to manipulate cart quantities, potentially wrapping them to negative values. The issue arises when the order creation process fails to validate these quantities, leading to an unintentional increase in inventory and the creation of negative-value orders.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/qiujie/mall | [email protected] | Broken LinkVendor |
| https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-106676.md | [email protected] | ExploitTechnical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-190 | Integer Overflow or Wraparound | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| qiujie mall-server | 0.0.1-SNAPSHOT (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |