PT-2024-22266 · Unknown · Apollo Router

Ivangoncharov · Published 2024-03-06 · Updated 2026-01-02 · CVE-2024-28101

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apollo Router versions 0.9.5 through 1.40.2

Description The Apollo Router is subject to a Denial-of-Service (DoS) type issue. When receiving compressed HTTP payloads, affected versions of the Router evaluate the limits.http max request bytes configuration option after the entirety of the compressed payload is decompressed. If affected versions of the Router receive highly compressed payloads, this could result in significant memory consumption while the compressed payload is expanded.

Recommendations For versions 0.9.5 through 1.40.1, upgrade to version 1.40.2 to resolve the issue. For those unable to upgrade, consider implementing mitigations at proxies or load balancers positioned in front of the Router fleet by creating limits on HTTP body upload size.

Exploit

Fix

DoS

Weakness Enumeration

CWE-409

Related Identifiers

CVE-2024-28101

GHSA-CGQF-3CQ5-WVCJ

Affected Products

Apollo Router

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28101.json · Exploit
• https://github.com/apollographql/router/commit/9e9527c73c8f34fc8438b09066163cd42520f413 · Patch
• https://github.com/apollographql/router/security/advisories/GHSA-cgqf-3cq5-wvcj · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cgqf-3cq5-wvcj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28101 · Security Note
• https://osv.dev/vulnerability/CVE-2024-28101 · Vendor Advisory
• https://github.com/apollographql/router · Note
• https://t.me/cveNotify/147499 · Telegram Post
• https://twitter.com/cracbot/status/1771321528778383362 · Twitter Post