TI-2025-23156 Aliases CVE-2025-32032 GHSA-94hh-jmq8-2fgp

Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass

MEDIUM 40CWE-770Published 2025-04-07 · Updated 2025-04-08

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.

Summary

The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. A vulnerability in Apollo Router allowed queries with deeply nested and reused named fragments to be prohibitively expensive to query plan, specifically due to internal optimizations being frequently bypassed. The query planner includes an optimization that significantly speeds up planning for applicable GraphQL selections. However, queries with deeply nested and reused named fragments can generate many selections where this optimization does not apply, leading to significantly longer planning times. Because the query planner does not enforce a timeout, a small number of such queries can exhaust router's thread pool, rendering it inoperable. This could lead to excessive resource consumption and denial of service. This has been remediated in apollo-router versions 1.61.2 and 2.1.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00596 48th percentileScored 2026-11-07

Fix Fixed router (apollographql): 1.61.2, 2.1.1apollo-router (crates.io): 1.61.2, 2.1.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
apollographql	router	before 1.61.2; 2.0.0-alpha.0 to before 2.1.1	1.61.2, 2.1.1	Patch available	CNA
—	apollo-router (crates.io)	before 1.61.2	1.61.2	Patch available	GHSA-94hh-jmq8-2fgp
—	apollo-router (crates.io)	2.0.0-alpha.0 to before 2.1.1	2.1.1	Patch available	GHSA-94hh-jmq8-2fgp

router Vendorapollographql Affected before 1.61.2; 2.0.0-alpha.0 to before 2.1.1 Fixed in 1.61.2, 2.1.1 Patch available CNA
apollo-router (crates.io) Vendor— Affected before 1.61.2 Fixed in 1.61.2 Patch available GHSA-94hh-jmq8-2fgp
apollo-router (crates.io) Vendor— Affected 2.0.0-alpha.0 to before 2.1.1 Fixed in 2.1.1 Patch available GHSA-94hh-jmq8-2fgp

Remediation

Fix · CNA router (apollographql) Fixed in 1.61.2, 2.1.1
Fix · GHSA-94hh-jmq8-2fgp apollo-router (crates.io) Fixed in 1.61.2 Advisory →
Fix · GHSA-94hh-jmq8-2fgp apollo-router (crates.io) Fixed in 2.1.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-32032
2026-10-03 Alias added: GHSA-94hh-jmq8-2fgp

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-32032

Other 4

TI-2024-21837 Defect in query plan cache may cause incorrect operations to be executed in Apollo Router CVSS 3.1CRITICAL 9.1
TI-2024-29063 Apollo Query Planner and Apollo Gateway may infinitely loop on sufficiently complex queries CVSS 3.1HIGH 7.5
TI-2026-19253 Apollo Server is vulnerable to denial of service with `startStandaloneServer` CVSS 3.1HIGH 7.5
TI-2025-23158 Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion CVSS 3.1HIGH 7.5
TI-2025-23157 Apollo Router Operation Limits Vulnerable to Bypass via Integer Overflow CVSS 3.1HIGH 7.5
TI-2025-23155 Apollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass CVSS 3.1HIGH 7.5

See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences