Executive brief
Apollo's query planning component (used in API gateways) can enter an infinite loop when processing sufficiently complex GraphQL queries involving multiple subgraphs. An attacker can craft a specially-crafted query to trigger unbounded memory consumption, crashing the service and causing denial of service to all API consumers.
Technical details
The vulnerability is a denial-of-service flaw in the Apollo Query Planner (versions 2.0.0–2.8.4) stemming from improper handling of numeric overflow in JavaScript's Number type. When calculating the total permutations of query plan candidates, the planner computes a product that can exceed Number.MAX_VALUE, causing JavaScript to evaluate it as "infinity". This causes the candidate-pruning optimization to fail entirely, forcing the planner to evaluate exponentially more candidates than necessary and consuming unbounded memory. The issue is triggered by sufficiently complex GraphQL queries where multiple subgraphs can resolve the same field—for example, a query with ~1024 aliased fields when two subgraphs can each resolve that field (2^1024 permutations). Apollo Gateway ≥2.0.0, <2.8.5 and Apollo Router <1.52.1 are also affected through their dependency on @apollo/query-planner. The attack requires network access to the GraphQL endpoint; no authentication or user interaction is needed.
Affected products
- Apollo Query Planner >=2.0.0, <2.8.5
- Apollo Gateway >=2.0.0, <2.8.5
- Apollo Router <1.52.1
Timeline
- 2024-08-27: disclosed
- 2024-08-27: patched: @apollo/query-planner 2.8.5, @apollo/gateway 2.8.5, Apollo Router 1.52.1