PT-2025-15295 · Unknown · Apollo Gateway

Jasonbarnett667

·

Published

2025-04-07

·

Updated

2025-08-01

·

CVE-2025-32031

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Apollo Gateway versions prior to 2.10.1
Description A vulnerability in Apollo Gateway allowed queries with deeply nested and reused named fragments to be prohibitively expensive to query plan, due to internal optimizations being frequently bypassed. This could lead to excessive resource consumption and denial of service. The query planner includes an optimization that significantly speeds up planning for applicable GraphQL selections, but queries with deeply nested and reused named fragments can generate many selections where this optimization does not apply, leading to significantly longer planning times.
Recommendations For versions prior to 2.10.1, update to version 2.10.1 to resolve the issue. As a temporary workaround, consider restricting the use of deeply nested and reused named fragments in queries to minimize the risk of excessive resource consumption and denial of service.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2025-32031
GHSA-P2Q6-PWH5-M6JR

Affected Products

Apollo Gateway