Read the docs
TI-2023-24573 Aliases CVE-2023-45812GHSA-r344-xw3p-2frj

Improper Check or Handling of Exceptional Conditions in apollo-router

Priority MEDIUM 40CWE-754Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability which causes the Router to panic and terminate when a multi-part response is sent. When users send queries to the router that uses the `@defer` or Subscriptions, the Router will panic. To be vulnerable, users of Router must have a coprocessor with `coprocessor.supergraph.response` configured in their `router.yaml` and also to support either `@defer` or Subscriptions. Apollo Router version 1.33.0 has a fix for this vulnerability which was introduced in PR #4014. Users are advised to upgrade. Users unable to upgrade should avoid using the coprocessor supergraph response or disable defer and subscriptions support and continue to use the coprocessor supergraph response.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00867 58th percentileScored 2026-11-07
Fix Fixed router (apollographql): 1.33.0apollo-router (crates.io): 1.33.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
apollographqlrouter1.31.0 to before 1.33.01.33.0Patch availableCNA
—apollo-router (crates.io)1.31.0 to before 1.33.01.33.0Patch availableGHSA-r344-xw3p-2frj
  • router Vendorapollographql Affected 1.31.0 to before 1.33.0 Fixed in 1.33.0 Patch available CNA
  • apollo-router (crates.io) Vendor— Affected 1.31.0 to before 1.33.0 Fixed in 1.33.0 Patch available GHSA-r344-xw3p-2frj

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:apollographql:apollo_router:*:*:*:*:*:*:*:*1.31.0 – 1.32.0Vulnerableapollographql
cpe:2.3:a:apollographql:apollo_helms-charts_router:*:*:*:*:*:*:*:*1.31.0 – 1.32.0Vulnerableapollographql
  • cpe:2.3:a:apollographql:apollo_router:*:*:*:*:*:*:*:* Versions 1.31.0 – 1.32.0 Vulnerable ·apollographql
  • cpe:2.3:a:apollographql:apollo_helms-charts_router:*:*:*:*:*:*:*:* Versions 1.31.0 – 1.32.0 Vulnerable ·apollographql

Remediation

  • Fix · CNA router (apollographql) Fixed in 1.33.0
  • Fix · GHSA-r344-xw3p-2frj apollo-router (crates.io) Fixed in 1.33.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-45812
  2. 2026-10-03 Alias added: GHSA-r344-xw3p-2frj

References

Patch 1

Advisory 2

Other 3

  • TI-2024-29063 Apollo Query Planner and Apollo Gateway may infinitely loop on sufficiently complex queries CVSS 3.1HIGH 7.5
  • TI-2024-29378 Apollo Router Coprocessors may cause Denial-of-Service when handling request bodies CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences