---
id: CVE-2026-106676
title: >-
  qiujie mall-server 0.0.1-SNAPSHOT contains an integer overflow in
  CartServiceImpl that allows an authenticated user to wrap a cart quantity to a
  negative value
summary: >-
  qiujie mall-server 0.0.1-SNAPSHOT contains an integer overflow in
  CartServiceImpl that allows an authenticated user to wrap a cart quantity to a
  negative value. The order creation flow does not validate the resulting
  quantity and passes …
severity: none
published: '2026-10-26'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T16:52:04.187Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-106676'
references:
  - url: 'https://github.com/qiujie/mall'
  - url: 'https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-106676.md'
tags:
  - cve.org
ingestedAt: '2026-10-26T17:33:33.062Z'
epss: 0.00156
epssPercentile: 0.04673
---

## Overview

qiujie mall-server 0.0.1-SNAPSHOT contains an integer overflow in CartServiceImpl that allows an authenticated user to wrap a cart quantity to a negative value. The order creation flow does not validate the resulting quantity and passes it to the stock update query, increasing inventory and creating negative-value orders.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.