Apollographql Router vulnerabilities

CVE-2024-32971 [CRITICAL] CWE-440 CVE-2024-32971: Apollo Router is a configurable, graph router written in Rust to run a federated supergraph that use Apollo Router is a configurable, graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. The affected versions of Apollo Router contain a bug that in limited circumstances, could lead to unexpected operations being executed which can result in unintended data or effects. This only affects Router instances configur

CVE-2025-64173 [HIGH] CWE-288 CVE-2025-64173: Apollo Router Core is a configurable graph router written in Rust to run a federated supergraph usin Apollo Router Core is a configurable graph router written in Rust to run a federated supergraph using Apollo Federation 2. In versions 1.61.11 below, as well as 2.0.0-alpha.0 through 2.8.1-rc.0, a vulnerability allowed for unauthenticated queries to access data that required additional access controls. Router incorrectly handled access control directi

CVE-2025-64347 [HIGH] CWE-284 CVE-2025-64347: Apollo Router Core is a configurable Rust graph router written to run a federated supergraph using A Apollo Router Core is a configurable Rust graph router written to run a federated supergraph using Apollo Federation 2. Versions 1.61.12-rc.0 and below and 2.8.1-rc.0 allow unauthorized access to protected data through schema elements with access control directives (@authenticated, @requiresScopes, and @policy) that were renamed via @link imports. Rou

CVE-2024-43783 [HIGH] CWE-770 CVE-2024-43783: The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a fed The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Instances of the Apollo Router running versions >=1.21.0 and =1.7.0 and <1.52.1 are impacted by a denial-of-service vulnerability if all of the following are true: 1. Router has been configured to use a c

CVE-2025-32033 [HIGH] CWE-119 CVE-2025-32033: The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a fed The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Prior to 1.61.2 and 2.1.1, the operation limits plugin uses unsigned 32-bit integers to track limit counters (e.g. for a query's height). If a counter exceeded the maximum value for this data type (4,294,

CVE-2024-28101 [HIGH] CWE-409 CVE-2024-28101: The Apollo Router is a graph router written in Rust to run a federated supergraph that uses Apollo F The Apollo Router is a graph router written in Rust to run a federated supergraph that uses Apollo Federation. Versions 0.9.5 until 1.40.2 are subject to a Denial-of-Service (DoS) type vulnerability. When receiving compressed HTTP payloads, affected versions of the Router evaluate the `limits.http_max_request_bytes` configuration option after the enti

CVE-2023-45812 [HIGH] CWE-754 CVE-2023-45812: The Apollo Router is a configurable, high-performance graph router written in Rust to run a federate The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability which causes the Router to panic and terminate when a multi-part response is sent. When users send queries to the router that uses th

CVE-2025-32032 [HIGH] CWE-770 CVE-2025-32032: The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a fed The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. A vulnerability in Apollo Router allowed queries with deeply nested and reused named fragments to be prohibitively expensive to query plan, specifically due to internal optimizations being frequently bypa

CVE-2025-32380 [HIGH] CWE-770 CVE-2025-32380: The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a fed The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. A vulnerability in Apollo Router's usage of Apollo Compiler allowed queries with deeply nested and reused named fragments to be prohibitively expensive to validate. This could lead to excessive resource c

CVE-2025-32034 [HIGH] CWE-770 CVE-2025-32034: The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a fed The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Prior to 1.61.2 and 2.1.1, a vulnerability in Apollo Router allowed queries with deeply nested and reused named fragments to be prohibitively expensive to query plan, specifically during named fragment ex

CVE-2023-41317 [MEDIUM] CWE-755 CVE-2023-41317: The Apollo Router is a configurable, high-performance graph router written in Rust to run a federate The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability which causes the Router to panic and terminate when GraphQL Subscriptions are enabled. It can be triggered when **all of the foll