Executive brief
Apollo Gateway is a service that routes and combines queries across multiple GraphQL APIs. A vulnerability in its query planning engine allows attackers to send specially crafted queries with deeply nested named fragments that consume excessive CPU and memory, causing the gateway to become unresponsive and denying legitimate traffic. This could disrupt API services relying on Apollo Gateway for GraphQL federation.
Technical details
The vulnerability is an uncontrolled resource allocation flaw (CWE-770) in the query planner's named fragment expansion logic. Named fragments were being expanded once per fragment spread during query planning without limits, leading to exponential resource consumption when deeply nested and reused fragments were combined. An unauthenticated network attacker can submit a malicious GraphQL query to trigger this condition; no special privileges or user interaction is required. The attack results in denial of service through CPU and memory exhaustion. The fix introduces a Query Fragment Expansion Limit metric that caps the number of selections a query can expand to, preventing excessive computation. Patches are available in @apollo/gateway 2.10.1 and later.
Affected products
- Apollo Gateway < 2.10.1
Timeline
- 2025-04-07: disclosed
- 2025-04-07: patched: Fixed in @apollo/gateway 2.10.1