Live › vulnerability › CVE-2026-106676
Go to dashboardqiujie mall-server 0.0.1-SNAPSHOT has an integer overflow in CartServiceImpl that lets an authenticated user wrap a cart quantity to a negative number. The order flow does not check the value, so the stock update raises inventory and orders with negative values are created.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 17:31 UTC. All times on this page are UTC.
Deployments of qiujie mall-server 0.0.1-SNAPSHOT where a logged-in customer can add items to a cart and place an order. The sources do not say whether anonymous or default configurations are affected. Teams not running this project can skip it.
No product ranges from the sources yet.
0.0.1-SNAPSHOT, and whether CartServiceImpl is in the codebaseEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
qiujie mall-server 0.0.1-SNAPSHOT contains an integer overflow in CartServiceImpl that allows an authenticated user to wrap a cart quantity to a negative value. The order creation flow does not validate the resulting quantity and passes it to the stock update query, increasing inventory and creating negative-value orders.
This page as .md · .json · in your agent: get_signal("CVE-2026-106676")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.