Apollographql Apollo-Router vulnerabilities

CVE-2024-32971 [CRITICAL] CWE-440 Apollo Router vulnerable to Critical Regression In Query Plan Cache Apollo Router vulnerable to Critical Regression In Query Plan Cache ### Impact Any instance of Apollo Router 1.44.0 or 1.45.0 that is using Distributed Query Plan Caching is impacted. These versions were released on 2024-04-12 and 2024-04-22 respectively. The affected versions of Apollo Router contain a bug that could lead to unexpected operations being executed, which can result in unintended

CVE-2025-64173 [HIGH] CWE-288 Apollo Router Affected by an Access Control Bypass on Polymorphic Types Apollo Router Affected by an Access Control Bypass on Polymorphic Types # Summary A vulnerability in Apollo Router allowed for unauthenticated queries to access data that required additional access controls. Router incorrectly handled access control directives on interface types/fields and their implementing object types/fields, applying them to interface types/fields while ignoring directives

CVE-2025-64347 [HIGH] CWE-284 Apollo Router Improperly Enforces Renamed Access Control Directives Apollo Router Improperly Enforces Renamed Access Control Directives # Summary A vulnerability in Apollo Router allowed for unauthorized access to protected data through schema elements with access control directives (`@authenticated`, `@requiresScopes`, and `@policy`) that were renamed via `@link` imports. Router did not enforce renamed access control directives on schema elements (e.g. fields and

CVE-2024-43783 [HIGH] CWE-770 CVE-2024-43783: The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a fed The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Instances of the Apollo Router running versions >=1.21.0 and =1.7.0 and <1.52.1 are impacted by a denial-of-service vulnerability if all of the following are true: 1. Router has been configured to use a c

CVE-2024-43414 [HIGH] CWE-674 CVE-2024-43414: Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Each tea Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Each team can own their slice of the graph independently, empowering them to deliver autonomously and incrementally. Instances of @apollo/query-planner >=2.0.0 and =2.0.0 and < 2.8.5 and Apollo Router <1.52.1 are also impacted through their use of @apollo/query

CVE-2025-32033 [HIGH] CWE-190 Apollo Router Operation Limits Vulnerable to Bypass via Integer Overflow Apollo Router Operation Limits Vulnerable to Bypass via Integer Overflow # Impact ## Summary A vulnerability in Apollo Router allowed certain queries to bypass configured operation limits, specifically due to integer overflow. ## Details The operation limits plugin uses unsigned 32-bit integers to track limit counters (e.g. for a query's height). If a counter exceeded the maximum value for

CVE-2024-28101 [HIGH] CWE-409 Apollo Router's Compressed Payloads do not respect HTTP Payload Limits Apollo Router's Compressed Payloads do not respect HTTP Payload Limits ### Impact The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability. When receiving compressed HTTP payloads, affected versions of the Router evaluate the `limits.h

CVE-2023-45812 [HIGH] CWE-703 Apollo Router vulnerable to Improper Check or Handling of Exceptional Conditions Apollo Router vulnerable to Improper Check or Handling of Exceptional Conditions ### Impact The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability which causes the Router to panic and terminate when a multi-part response is

CVE-2025-32032 [HIGH] CWE-770 Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass # Impact ## Summary A vulnerability in Apollo Router allowed queries with deeply nested and reused named fragments to be prohibitively expensive to query plan, specifically due to internal optimizations being frequently bypassed. This could lead to excessive resource consu

CVE-2025-32380 [HIGH] CWE-770 Apollo Router Query Validation Vulnerable to Excessive Resource Consumption via Named Fragment Processing Apollo Router Query Validation Vulnerable to Excessive Resource Consumption via Named Fragment Processing # Impact ## Summary A vulnerability in Apollo Router's usage of Apollo Compiler allowed queries with deeply nested and reused named fragments to be prohibitively expensive to validate. This could lead to excessive resource consumption and denial of servic

CVE-2025-32034 [HIGH] CWE-770 Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion # Impact ## Summary A vulnerability in Apollo Router allowed queries with deeply nested and reused named fragments to be prohibitively expensive to query plan, specifically during named fragment expansion. This could lead to excessive resource consumption and den

CVE-2023-41317 [MEDIUM] CWE-755 Apollo Router Unnamed "Subscription" operation results in Denial-of-Service Apollo Router Unnamed "Subscription" operation results in Denial-of-Service ### Impact This is a Denial-of-Service (DoS) type vulnerability which causes the Router to panic and terminate when GraphQL Subscriptions are enabled. It can be triggered when **all of the following conditions are met**: 1. Running Apollo Router v1.28.0, v1.28.1 or v1.29.0 ("impacted versions"); **and** 2. The S