Executive brief
Apache APISIX is an API gateway used to manage and route API traffic. A vulnerability allows an attacker to send a single small request to the graphql-limit-count route, causing a gateway worker process to consume 100% CPU for an extended period, resulting in denial of service and degraded API availability.
Technical details
This is an inefficient algorithmic complexity vulnerability affecting the graphql-limit-count route handler in Apache APISIX. The vulnerability allows an unauthenticated remote attacker to trigger excessive CPU consumption on a gateway worker by sending a specially crafted request, resulting in a denial-of-service condition. The attack requires network access to the API gateway and no authentication. Apache APISIX version 3.17.0 is affected; the issue is fixed in version 3.18.0.
Affected products
- Apache APISIX 3.17.0
Timeline
- 2026-08-26: disclosed: Vulnerability disclosed on oss-security mailing list
- 2026-08-27: published: CVE-2026-75005 published
- 2026-08-27: patched: Fix available in Apache APISIX 3.18.0