Executive brief
Apollo Gateway is a GraphQL API gateway that routes and executes queries across federated services. A vulnerability in its query planner allows attackers to craft deeply nested and reused named fragments that bypass internal optimizations, causing excessive CPU consumption and rendering the gateway unresponsive. This can result in service outages affecting all downstream applications and users dependent on the gateway.
Technical details
This vulnerability is a resource exhaustion flaw (CWE-770) in the Apollo Gateway query planner. Queries with deeply nested and reused named fragments generate many selections that bypass the existing optimization intended to speed up query planning, resulting in significantly longer planning times. The query planner lacks a timeout mechanism, allowing a small number of malicious queries to consume excessive CPU and memory resources without bounds. Attack preconditions are minimal: the attacker needs network access to submit GraphQL queries (no authentication required). An attacker can trigger denial of service by submitting crafted queries. The vulnerability has been patched in @apollo/gateway version 2.10.1, which introduces a Query Optimization Limit metric to enforce a ceiling on unoptimizable selections.
Affected products
- Apollo Gateway < 2.10.1
Timeline
- 2025-04-07: disclosed
- 2025-04-07: patched: patched in @apollo/gateway version 2.10.1