# CVE-2024-43414: Apollo Query Planner infinite loop on complex queries

Source: https://junglewise.ai/threats/cve-2024-43414-apollo-query-planner-infinite-loop-on-complex-queries  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-43414 · Severity: low · CVSS 3.1 · Published 2024-08-27

Apollo's query planning component (used in API gateways) can enter an infinite loop when processing sufficiently complex GraphQL queries involving multiple subgraphs. An attacker can craft a specially-crafted query to trigger unbounded memory consumption, crashing the service and causing denial of service to all API consumers.

Technologies: [apollo-router (crates.io)](https://junglewise.ai/threats/technologies/apollo-router), [@apollo/gateway (npm)](https://junglewise.ai/threats/technologies/apollo-gateway). Vendors: [Apollo](https://junglewise.ai/threats/vendors/apollo), [crates.io](https://junglewise.ai/threats/vendors/crates-io), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2024-43414 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-43414 being exploited in the wild.

**How severe is CVE-2024-43414?** Low severity, with a CVSS score of 3.1, published 27 August 2024.

**Which products and versions are affected?** Apollo Query Planner >=2.0.0, <2.8.5; apollo-router (crates.io) SEMVER:introduced=0,fixed=1.52.1; @apollo/gateway (npm) SEMVER:introduced=2.0.0,fixed=2.8.5; @apollo/query-planner (npm) SEMVER:introduced=2.0.0,fixed=2.8.5.

**Is there a fix for CVE-2024-43414?** Yes. apollo-router (crates.io): upgrade to 1.52.1 or later; @apollo/gateway (npm): upgrade to 2.8.5 or later; @apollo/query-planner (npm): upgrade to 2.8.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-43414 attacked?** It is attacked over the network.

**Am I affected by CVE-2024-43414?** Check whether you run Apollo Query Planner, apollo-router (crates.io), @apollo/gateway (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- apollo-router (crates.io): upgrade to 1.52.1 or later

  ```sh
  cargo update -p apollo-router
  ```

- @apollo/gateway (npm): upgrade to 2.8.5 or later

  ```sh
  npm install @apollo/gateway@2.8.5
  ```

- @apollo/query-planner (npm): upgrade to 2.8.5 or later

  ```sh
  npm install @apollo/query-planner@2.8.5
  ```


## Technical details

The vulnerability is a denial-of-service flaw in the Apollo Query Planner (versions 2.0.0–2.8.4) stemming from improper handling of numeric overflow in JavaScript's Number type. When calculating the total permutations of query plan candidates, the planner computes a product that can exceed Number.MAX_VALUE, causing JavaScript to evaluate it as "infinity". This causes the candidate-pruning optimization to fail entirely, forcing the planner to evaluate exponentially more candidates than necessary and consuming unbounded memory. The issue is triggered by sufficiently complex GraphQL queries where multiple subgraphs can resolve the same field—for example, a query with ~1024 aliased fields when two subgraphs can each resolve that field (2^1024 permutations). Apollo Gateway ≥2.0.0, &lt;2.8.5 and Apollo Router &lt;1.52.1 are also affected through their dependency on @apollo/query-planner. The attack requires network access to the GraphQL endpoint; no authentication or user interaction is needed.

## Affected products

- Apollo Query Planner >=2.0.0, <2.8.5
- Apollo Gateway >=2.0.0, <2.8.5
- Apollo Router <1.52.1

## Identifiers

- CVE-2024-43414
- GHSA-fmj9-77q8-g6c4

## Timeline

- 2024-08-27: disclosed
- 2024-08-27: patched: @apollo/query-planner 2.8.5, @apollo/gateway 2.8.5, Apollo Router 1.52.1

## References

- [https://github.com/apollographql/federation/security/advisories/GHSA-fmj9-77q8-g6c4](https://github.com/apollographql/federation/security/advisories/GHSA-fmj9-77q8-g6c4)

## Related threats

- [Apollo Router Core: Browser Bug Enables Bypass of XS-Search Prevention via Read-Only Cross-Site Request Forgery](https://junglewise.ai/threats/apollo-router-core-browser-bug-enables-bypass-of-xs-search-prevention-5a0d5dcd)
- [Apollo Federation prototype pollution via incomplete key sanitization](https://junglewise.ai/threats/cve-2026-32621-apollo-federation-prototype-pollution-via-incomplete-key)
- [Apollo Router Affected by an Access Control Bypass on Polymorphic Types](https://junglewise.ai/threats/cve-2025-64173-apollo-router-affected-by-an-access-control-bypass-on-polymorphic)
- [Apollo Router Improperly Enforces Renamed Access Control Directives](https://junglewise.ai/threats/cve-2025-64347-apollo-router-improperly-enforces-renamed-access-control)
- [Apollo Gateway Query Planner denial of service via optimization bypass](https://junglewise.ai/threats/cve-2025-32031-apollo-gateway-query-planner-denial-of-service-via-optimization)