Loading...
Skip to main content
GeekWala

CVE-2024-28101

HIGH

Apollo Router's Compressed Payloads do not respect HTTP Payload Limits

Published March 6, 2024Updated February 17, 2026Source: osv

Summary

### Impact The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability. When receiving compressed HTTP payloads, affected versions of the Router evaluate the `limits.http_max_request_bytes` configuration option after the entirety of the compressed payload is decompressed. If affected versions of the Router receive highly compressed payloads, this could result in significant memory consumption while the compressed payload is expanded. ### Patches Router version 1.40.2 has a fix for the vulnerability. ### Workarounds If you are unable to upgrade, you may be able to implement mitigations at proxies or load balancers positioned in front of your Router fleet (e.g. Nginx, HAProxy, or cloud-native WAF services) by creating limits on HTTP body upload size.

Remediation

Upgrade to the fixed version using your package manager.

Cargo
Update apollo-router to 1.40.2 or later
cargo update -p apollo-router --precise 1.40.2

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

PackageEcosystemAffectedFixed In
apollo-router
crates.io
All versions1.40.2

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 7.5 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Frequently Asked Questions

What is CVE-2024-28101?
Apollo Router's Compressed Payloads do not respect HTTP Payload Limits This vulnerability has been assigned a severity rating of HIGH (CVSS score: 7.5/10).
How do I check if my project is affected by CVE-2024-28101?
CVE-2024-28101 affects apollo-router. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2024-28101 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
7.5

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-cgqf-3cq5-wvcj

Related CVEs

  • CVE-2024-32971
    CRITICAL

    Apollo Router vulnerable to Critical Regression In Query Plan Cache

  • CVE-2025-32380
    HIGH

    Apollo Router Query Validation Vulnerable to Excessive Resource Consumption via Named Fragment Processing

  • CVE-2025-32034
    HIGH

    Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion

  • CVE-2025-32033
    HIGH

    Apollo Router Operation Limits Vulnerable to Bypass via Integer Overflow

  • CVE-2025-32032
    HIGH

    Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass

  • CVE-2024-43414
    HIGH

    Apollo Query Planner and Apollo Gateway may infinitely loop on sufficiently complex queries

  • CVE-2025-64347
    HIGH

    Apollo Router Improperly Enforces Renamed Access Control Directives

  • CVE-2023-45812
    HIGH

    Apollo Router vulnerable to Improper Check or Handling of Exceptional Conditions

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies