PT-2025-15756 · Apollo · Apollo Router

Yo-Artyom · Published 2025-04-07 · Updated 2025-04-14 · CVE-2025-32380

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Apollo Router versions prior to 1.61.2 Apollo Router versions prior to 2.1.1

Description: A vulnerability in Apollo Router's usage of Apollo Compiler allowed queries with deeply nested and reused named fragments to be prohibitively expensive to validate, leading to excessive resource consumption and denial of service. The issue has been remediated by updating the validation logic to process each named fragment only once, preventing redundant traversal.

Recommendations: For Apollo Router versions prior to 1.61.2, update to version 1.61.2 or later to resolve the issue. For Apollo Router versions prior to 2.1.1, update to version 2.1.1 or later to resolve the issue.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2025-32380

GHSA-3J43-9V8V-CP3F

Affected Products

Apollo Router

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32380.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-32380 · Security Note
• https://osv.dev/vulnerability/GHSA-3j43-9v8v-cp3f · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-32380 · Vendor Advisory
• https://github.com/apollographql/router · Note
• https://github.com/apollographql/router/security/advisories/GHSA-3j43-9v8v-cp3f · Note
• https://github.com/apollographql/router/commit/ab6675a63174715ea6ff50881fc957831d4e9564 · Note
• https://github.com/apollographql/router/commit/bba032e183b861348a466d3123c7137a1ae18952 · Note
• https://twitter.com/cracbot/status/1911736269702389777 · Twitter Post
• https://twitter.com/CVEnew/status/1910073448488988860 · Twitter Post
• https://twitter.com/cybercronai/status/1910366426008818103 · Twitter Post