Apollographql Apollo Router vulnerabilities

CVE-2024-43783 [HIGH] CWE-770 CVE-2024-43783: The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a fed The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Instances of the Apollo Router running versions >=1.21.0 and =1.7.0 and <1.52.1 are impacted by a denial-of-service vulnerability if all of the following are true: 1. Router has been configured to use a c

CVE-2024-43414 [HIGH] CWE-674 CVE-2024-43414: Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Each tea Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Each team can own their slice of the graph independently, empowering them to deliver autonomously and incrementally. Instances of @apollo/query-planner >=2.0.0 and =2.0.0 and < 2.8.5 and Apollo Router <1.52.1 are also impacted through their use of @apollo/query

CVE-2024-28101 [HIGH] CWE-409 CVE-2024-28101: The Apollo Router is a graph router written in Rust to run a federated supergraph that uses Apollo F The Apollo Router is a graph router written in Rust to run a federated supergraph that uses Apollo Federation. Versions 0.9.5 until 1.40.2 are subject to a Denial-of-Service (DoS) type vulnerability. When receiving compressed HTTP payloads, affected versions of the Router evaluate the `limits.http_max_request_bytes` configuration option after the enti

CVE-2023-45812 [HIGH] CWE-754 CVE-2023-45812: The Apollo Router is a configurable, high-performance graph router written in Rust to run a federate The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability which causes the Router to panic and terminate when a multi-part response is sent. When users send queries to the router that uses th

CVE-2023-41317 [MEDIUM] CWE-755 CVE-2023-41317: The Apollo Router is a configurable, high-performance graph router written in Rust to run a federate The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability which causes the Router to panic and terminate when GraphQL Subscriptions are enabled. It can be triggered when **all of the foll