PT-2025-15298 · Unknown · Apollo Router Core
Published
2025-04-07
·
Updated
2025-04-08
·
CVE-2025-32034
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Apollo Router Core versions prior to 1.61.2
Apollo Router Core versions prior to 2.1.1
Description
The issue concerns a vulnerability in the Apollo Router Core that allows queries with deeply nested and reused named fragments to be prohibitively expensive to query plan. This occurs during named fragment expansion, where named fragments are expanded once per fragment spread during query planning, leading to exponential resource usage when deeply nested and reused fragments are involved. This could result in excessive resource consumption and denial of service.
Recommendations
For versions prior to 1.61.2, update to version 1.61.2 or later to resolve the issue.
For versions prior to 2.1.1, update to version 2.1.1 or later to resolve the issue.
Exploit
Fix
DoS
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Apollo Router Core