TI-2025-23158 Aliases CVE-2025-32034 GHSA-75m2-jhh5-j5g2

Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion

MEDIUM 40CWE-770Published 2025-04-07 · Updated 2025-04-08

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.

Summary

The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Prior to 1.61.2 and 2.1.1, a vulnerability in Apollo Router allowed queries with deeply nested and reused named fragments to be prohibitively expensive to query plan, specifically during named fragment expansion. Named fragments were being expanded once per fragment spread during query planning, leading to exponential resource usage when deeply nested and reused fragments were involved. This could lead to excessive resource consumption and denial of service. This has been remediated in apollo-router versions 1.61.2 and 2.1.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00559 46th percentileScored 2026-11-07

Fix Fixed router (apollographql): 1.61.2, 2.1.1apollo-router (crates.io): 1.61.2, 2.1.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
apollographql	router	before 1.61.2; 2.0.0-alpha.0 to before 2.1.1	1.61.2, 2.1.1	Patch available	CNA
—	apollo-router (crates.io)	before 1.61.2	1.61.2	Patch available	GHSA-75m2-jhh5-j5g2
—	apollo-router (crates.io)	2.0.0-alpha.0 to before 2.1.1	2.1.1	Patch available	GHSA-75m2-jhh5-j5g2

router Vendorapollographql Affected before 1.61.2; 2.0.0-alpha.0 to before 2.1.1 Fixed in 1.61.2, 2.1.1 Patch available CNA
apollo-router (crates.io) Vendor— Affected before 1.61.2 Fixed in 1.61.2 Patch available GHSA-75m2-jhh5-j5g2
apollo-router (crates.io) Vendor— Affected 2.0.0-alpha.0 to before 2.1.1 Fixed in 2.1.1 Patch available GHSA-75m2-jhh5-j5g2

Remediation

Fix · CNA router (apollographql) Fixed in 1.61.2, 2.1.1
Fix · GHSA-75m2-jhh5-j5g2 apollo-router (crates.io) Fixed in 1.61.2 Advisory →
Fix · GHSA-75m2-jhh5-j5g2 apollo-router (crates.io) Fixed in 2.1.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-32034
2026-10-03 Alias added: GHSA-75m2-jhh5-j5g2

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-32034

Other 4

TI-2024-21837 Defect in query plan cache may cause incorrect operations to be executed in Apollo Router CVSS 3.1CRITICAL 9.1
TI-2024-29063 Apollo Query Planner and Apollo Gateway may infinitely loop on sufficiently complex queries CVSS 3.1HIGH 7.5
TI-2026-19253 Apollo Server is vulnerable to denial of service with `startStandaloneServer` CVSS 3.1HIGH 7.5
TI-2025-23157 Apollo Router Operation Limits Vulnerable to Bypass via Integer Overflow CVSS 3.1HIGH 7.5
TI-2025-23156 Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass CVSS 3.1HIGH 7.5
TI-2025-23155 Apollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass CVSS 3.1HIGH 7.5

See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences