CVE-2024-43414: Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Each team can own their slice of the graph independently…

PriorityP340high7.5CVSS 3.1

AVNACLPRNUINSUCNINAH

EPSS

0.99%

58.5th percentile

Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Each team can own their slice of the graph independently, empowering them to deliver autonomously and incrementally. Instances of @apollo/query-planner >=2.0.0 and =2.0.0 and < 2.8.5 and Apollo Router <1.52.1 are also impacted through their use of @apollo/query-panner. If @apollo/query-planner is asked to plan a sufficiently complex query, it may loop infinitely and never complete. This results in unbounded memory consumption and either a crash or out-of-memory (OOM) termination. This issue can be triggered if you have at least one non-@key field that can be resolved by multiple subgraphs. To identify these shared fields, the schema for each subgraph must be reviewed. The mechanism to identify shared fields varies based on the version of Federation your subgraphs are using. You can check if your subgraphs are using Federation 1 or Federation 2 by reviewing their schemas. Federation 2 subgraph schemas will contain a @link directive referencing the version of Federation being used while Federation 1 subgraphs will not. For example, in a Federation 2 subgraph, you will find a line like @link(url: "https://specs.apollo.dev/federation/v2.0"). If a similar @link directive is not present in your subgraph schema, it is using Federation 1. Note that a supergraph can contain a mix of Federation 1 and Federation 2 subgraphs. This issue results from the Apollo query planner attempting to use a Number exceeding Javascript’s Number.MAX_VALUE in some cases. In Javascript, Number.MAX_VALUE is (2^1024 - 2^971). When the query planner receives an inbound graphql request, it breaks the query into pieces and for each piece, generates a list of potential execution steps to solve the piece. These candidates represent the steps that the query planner will take to satisfy the pieces of the larger query. As part of normal operations, the query planner requires and calculates the number of possible qu

Affected

10 ranges

Vendor	Product	Version range	Fixed in
apollo	gateway	>= 2.0.0 < 2.8.5	2.8.5
apollo	query-planner	>= 2.0.0 < 2.8.5	2.8.5
apollographql	apollo-router	< 1.52.1	1.52.1
apollographql	apollo-router	>= 0 < 1.52.1	1.52.1
apollographql	apollo_gateway	>= 2.0.0 < 2.8.5	2.8.5
apollographql	apollo_helms-charts_router	< 1.52.1	1.52.1
apollographql	apollo_query-planner	>= 2.0.0 < 2.8.5	2.8.5
apollographql	apollo_router	< 1.52.1	1.52.1
apollographql	federation	< 1.52.1	1.52.1
apollographql	federation	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.