CVE-2024-28101: Apollo Router DoS Vulnerability

CVE-2024-28101 Overview

CVE-2024-28101 affects the Apollo Router, a graph router written in Rust that runs federated supergraphs using Apollo Federation. Versions 0.9.5 through 1.40.1 evaluate the limits.http_max_request_bytes configuration only after fully decompressing incoming HTTP payloads. Attackers can send highly compressed request bodies that expand to consume large amounts of memory during decompression. The flaw is categorized under [CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)]. Apollo released version 1.40.2 to address the issue.

Critical Impact
Unauthenticated remote attackers can trigger memory exhaustion on Apollo Router instances by sending small, highly compressed HTTP payloads, causing denial-of-service across federated GraphQL infrastructure.

Affected Products

Apollo Router versions 0.9.5 through 1.40.1
Federated supergraphs running Apollo Federation behind affected Router versions
Deployments without upstream HTTP body size limits at proxy or load balancer layer

Discovery Timeline

2024-03-21 - CVE-2024-28101 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-28101

Vulnerability Analysis

The Apollo Router accepts compressed HTTP request bodies using standard content encodings such as gzip, deflate, and br. The limits.http_max_request_bytes configuration option is intended to cap the size of incoming request bodies. In affected versions, the Router applies this limit only after decompression completes. An attacker can craft a small payload that expands by orders of magnitude during decompression, a pattern commonly known as a decompression bomb. The expanded data is buffered in memory before the size check runs, so the limit cannot prevent resource exhaustion. Repeated requests against the same instance amplify the impact and can render the Router unresponsive to legitimate GraphQL traffic.

Root Cause

The root cause is improper ordering of input validation relative to decompression. The Router decompresses the entire request body into memory before comparing its size against the configured byte limit. This violates safe handling guidance for compressed inputs, where size checks should be enforced incrementally during decompression or based on the compressed payload size. The defect maps to [CWE-409], which addresses failure to handle data amplification in compressed inputs.

Attack Vector

Exploitation requires only network access to a Router endpoint that accepts compressed HTTP requests. The attacker sends a POST request with a Content-Encoding header set to a supported algorithm and a body that decompresses to a much larger size. No authentication, user interaction, or special privileges are required. The vulnerability impacts availability only, with no direct effect on confidentiality or integrity. EPSS data places the exploitation probability at 0.77%.

No verified public proof-of-concept code is available. The Apollo Security Advisory GHSA-cgqf-3cq5-wvcj describes the technical behavior, and the upstream fix commit shows the corrected handling of compressed payloads.

Detection Methods for CVE-2024-28101

Indicators of Compromise

Sudden spikes in Apollo Router process memory usage without corresponding increases in request count or query complexity
HTTP requests with Content-Encoding: gzip, deflate, or br and unusually small Content-Length values producing large in-memory payloads
Router instances becoming unresponsive or restarting under low external traffic volume
Out-of-memory (OOM) kill events for the Router process in container or host logs

Detection Strategies

Monitor the ratio between compressed request size and decompressed body size at the ingress proxy or WAF
Alert on Router pods or processes that exceed memory thresholds shortly after receiving compressed POST requests
Inspect access logs for repeated compressed requests from the same source IP targeting GraphQL endpoints

Monitoring Recommendations

Export Router runtime metrics (memory, request duration, active connections) to a centralized observability platform
Track HTTP request size distribution and decompression ratios at the load balancer or reverse proxy tier
Configure alerting on rapid memory growth and OOM events tied to the Router workload

How to Mitigate CVE-2024-28101

Immediate Actions Required

Upgrade Apollo Router to version 1.40.2 or later across all environments
Inventory all Router deployments and confirm the running version using the Router's startup logs or health endpoint
Enforce HTTP body size limits at upstream proxies, load balancers, or WAF services in front of the Router
Restrict accepted Content-Encoding values where compression is not required by clients

Patch Information

Apollo released the fix in Apollo Router 1.40.2. The corrective change is published in the upstream commit 9e9527c and described in the GitHub Security Advisory GHSA-cgqf-3cq5-wvcj. Operators running any version from 0.9.5 through 1.40.1 should upgrade.

Workarounds

Configure Nginx, HAProxy, or a cloud-native WAF in front of the Router to cap raw HTTP body size before requests reach the Router
Reject requests with unusual decompression ratios at the WAF layer where supported
Disable client-side compression on Router ingress if it is not required by federated clients

bash

# Example Nginx configuration limiting HTTP body size in front of Apollo Router
http {
    client_max_body_size 1m;

    server {
        listen 443 ssl;
        server_name router.example.com;

        location / {
            proxy_pass http://apollo_router_upstream;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
        }
    }
}