TI-2025-23157 Aliases CVE-2025-32033 GHSA-84m6-5m72-45fp

Apollo Router Operation Limits Vulnerable to Bypass via Integer Overflow

MEDIUM 40CWE-119Published 2025-04-07 · Updated 2025-04-08

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-119 and the CVSS impact.

Summary

The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Prior to 1.61.2 and 2.1.1, the operation limits plugin uses unsigned 32-bit integers to track limit counters (e.g. for a query's height). If a counter exceeded the maximum value for this data type (4,294,967,295), it wrapped around to 0, unintentionally allowing queries to bypass configured thresholds. This could occur for large queries if the payload limit were sufficiently increased, but could also occur for small queries with deeply nested and reused named fragments. This has been remediated in apollo-router versions 1.61.2 and 2.1.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00596 48th percentileScored 2026-11-07

Fix Fixed router (apollographql): 1.61.2, 2.1.1apollo-router (crates.io): 1.61.2, 2.1.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
apollographql	router	before 1.61.2; 2.0.0-alpha.0 to before 2.1.1	1.61.2, 2.1.1	Patch available	CNA
—	apollo-router (crates.io)	before 1.61.2	1.61.2	Patch available	GHSA-84m6-5m72-45fp
—	apollo-router (crates.io)	2.0.0-alpha.0 to before 2.1.1	2.1.1	Patch available	GHSA-84m6-5m72-45fp

router Vendorapollographql Affected before 1.61.2; 2.0.0-alpha.0 to before 2.1.1 Fixed in 1.61.2, 2.1.1 Patch available CNA
apollo-router (crates.io) Vendor— Affected before 1.61.2 Fixed in 1.61.2 Patch available GHSA-84m6-5m72-45fp
apollo-router (crates.io) Vendor— Affected 2.0.0-alpha.0 to before 2.1.1 Fixed in 2.1.1 Patch available GHSA-84m6-5m72-45fp

Remediation

Fix · CNA router (apollographql) Fixed in 1.61.2, 2.1.1
Fix · GHSA-84m6-5m72-45fp apollo-router (crates.io) Fixed in 1.61.2 Advisory →
Fix · GHSA-84m6-5m72-45fp apollo-router (crates.io) Fixed in 2.1.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-32033
2026-10-03 Alias added: GHSA-84m6-5m72-45fp

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-32033

Other 4

TI-2024-21837 Defect in query plan cache may cause incorrect operations to be executed in Apollo Router CVSS 3.1CRITICAL 9.1
TI-2024-29063 Apollo Query Planner and Apollo Gateway may infinitely loop on sufficiently complex queries CVSS 3.1HIGH 7.5
TI-2026-19253 Apollo Server is vulnerable to denial of service with `startStandaloneServer` CVSS 3.1HIGH 7.5
TI-2025-23158 Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion CVSS 3.1HIGH 7.5
TI-2025-23156 Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass CVSS 3.1HIGH 7.5
TI-2025-23155 Apollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass CVSS 3.1HIGH 7.5

See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences