CVE-2025-32032: Apollo Router Core DOS Vulnerability

CVE-2025-32032 Overview

A denial of service vulnerability exists in Apollo Router Core, a configurable, high-performance graph router written in Rust designed to run federated supergraphs using Apollo Federation 2. The vulnerability allows attackers to craft GraphQL queries with deeply nested and reused named fragments that become prohibitively expensive to plan, causing resource exhaustion and rendering the router inoperable.

Critical Impact
Malicious actors can send specially crafted GraphQL queries to exhaust the router's thread pool, causing complete denial of service for all users of the affected Apollo Router instance.

Affected Products

Apollo Router Core versions prior to 1.61.2
Apollo Router Core versions prior to 2.1.1

Discovery Timeline

2025-04-07 - CVE CVE-2025-32032 published to NVD
2025-04-08 - Last updated in NVD database

Technical Details for CVE-2025-32032

Vulnerability Analysis

This vulnerability is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). The Apollo Router's query planner includes an optimization designed to significantly speed up planning for applicable GraphQL selections. However, when processing queries containing deeply nested and reused named fragments, this optimization is frequently bypassed, generating numerous selections that cannot benefit from the performance enhancement.

The core issue is that the query planner operates without a timeout mechanism. When attackers submit queries specifically crafted with complex fragment nesting patterns, the planning phase consumes excessive computational resources. A small number of these malicious queries can completely exhaust the router's available thread pool, preventing legitimate requests from being processed and effectively taking the service offline.

Root Cause

The vulnerability stems from improper resource allocation controls in the query planning subsystem. The query planner lacks adequate safeguards to limit the time and resources consumed when processing complex GraphQL queries. When internal optimizations are bypassed due to specific query structures involving deeply nested fragments, the planning operation becomes computationally expensive without any enforcement mechanism to terminate long-running operations.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending carefully crafted GraphQL queries to the Apollo Router endpoint. The malicious queries leverage deeply nested and reused named fragments in a pattern that consistently bypasses the query planner's optimization paths.

The attack flow involves:

Crafting GraphQL queries with complex nested fragment structures
Sending multiple such queries to the target Apollo Router endpoint
Each query consumes significant thread pool resources during the planning phase
As threads become occupied with expensive planning operations, the thread pool becomes exhausted
Legitimate queries are unable to be processed, resulting in denial of service

Detection Methods for CVE-2025-32032

Indicators of Compromise

Abnormally high CPU utilization on Apollo Router instances without corresponding increases in legitimate traffic
GraphQL queries containing unusually deep fragment nesting levels in request logs
Thread pool exhaustion warnings or errors in Apollo Router logs
Sudden increase in response latency or timeout errors for GraphQL requests

Detection Strategies

Monitor query planning duration metrics for anomalous spikes indicating computationally expensive operations
Implement query complexity analysis to identify and alert on queries with excessive fragment nesting
Set up alerts for thread pool utilization thresholds approaching exhaustion levels
Analyze GraphQL query patterns in web application firewalls for suspicious fragment usage

Monitoring Recommendations

Enable detailed query logging to capture fragment structure information for post-incident analysis
Configure application performance monitoring to track query planner execution times
Implement rate limiting on GraphQL endpoints to reduce the impact of query-based attacks
Set up automated alerts when thread pool availability drops below operational thresholds

How to Mitigate CVE-2025-32032

Immediate Actions Required

Upgrade Apollo Router Core to version 1.61.2 or later for the 1.x release line
Upgrade Apollo Router Core to version 2.1.1 or later for the 2.x release line
Review GraphQL endpoint exposure and consider implementing additional query validation controls
Monitor router health metrics closely until patches can be applied

Patch Information

Apollo has released security patches addressing this vulnerability. The fixes are available in the following commits:

For complete details about the vulnerability and remediation, refer to the GitHub Security Advisory GHSA-94hh-jmq8-2fgp.

Workarounds

Implement query depth limiting at the API gateway or web application firewall level to reject excessively nested queries
Configure connection and request timeouts to limit the impact of long-running query planning operations
Deploy rate limiting on GraphQL endpoints to reduce the number of malicious queries that can be processed
Consider implementing query cost analysis plugins to reject queries exceeding complexity thresholds before they reach the query planner

bash

# Example: Upgrading Apollo Router using npm
npm update @apollo/router@1.61.2
# Or for 2.x line
npm update @apollo/router@2.1.1