CVE-2025-32380: Apollo Router Core DoS Vulnerability

CVE-2025-32380 Overview

A denial of service vulnerability exists in Apollo Router Core, a high-performance graph router written in Rust designed to run federated supergraphs using Apollo Federation 2. The vulnerability stems from improper resource allocation when processing GraphQL queries containing deeply nested and reused named fragments, classified as CWE-770 (Allocation of Resources Without Limits or Throttling).

Critical Impact

Attackers can craft malicious GraphQL queries with deeply nested named fragments to cause excessive CPU and memory consumption, leading to denial of service conditions that can disrupt critical API gateway infrastructure.

Affected Products

• Apollo Router Core versions prior to 1.61.2
• Apollo Router Core versions 2.x prior to 2.1.1
• Systems using Apollo Compiler with vulnerable validation logic

Discovery Timeline

• April 9, 2025 - CVE-2025-32380 published to NVD
• April 15, 2026 - Last updated in NVD database

Technical Details for CVE-2025-32380

Vulnerability Analysis

The vulnerability resides in Apollo Router's integration with Apollo Compiler, specifically in how the validation logic processes named fragments in GraphQL queries. When a query contains deeply nested named fragments that are reused multiple times, the validation process would traverse each fragment instance separately rather than processing unique fragments once. This redundant traversal creates an algorithmic complexity issue where the computational cost grows exponentially with the depth and reuse of fragments.

The attack requires no authentication or user interaction, making it easily exploitable over the network. While the vulnerability does not impact confidentiality or integrity, it can completely compromise the availability of affected Apollo Router instances, disrupting GraphQL API services for all users.

Root Cause

The root cause is CWE-770: Allocation of Resources Without Limits or Throttling. Apollo Compiler's fragment validation logic lacked optimization to track already-processed named fragments. When encountering reused named fragments within deeply nested query structures, the validator would redundantly traverse the same fragment definitions multiple times, leading to exponential resource consumption proportional to fragment nesting depth and reuse frequency.

Attack Vector

The attack vector is network-based, requiring an attacker to send specially crafted GraphQL queries to a vulnerable Apollo Router endpoint. The attacker constructs a query with deeply nested named fragment spreads where the same fragments are referenced multiple times at various nesting levels. When the router attempts to validate this query using Apollo Compiler, the redundant fragment processing consumes excessive CPU cycles and memory, eventually exhausting server resources.

The exploitation technique leverages algorithmic complexity—a small malicious payload can trigger disproportionately large computational work. This is particularly dangerous in GraphQL environments where query depth and complexity limits may not adequately protect against this specific fragment reuse pattern.

Detection Methods for CVE-2025-32380

Indicators of Compromise

• Unusual spikes in CPU and memory utilization on Apollo Router instances without corresponding increases in legitimate traffic
• GraphQL queries with abnormally deep nesting levels or excessive named fragment spreads in request logs
• Increased query validation latency or timeout errors in Apollo Router metrics
• Service degradation or unavailability reports coinciding with specific query patterns

Detection Strategies

• Implement monitoring for GraphQL query complexity metrics, specifically tracking fragment depth and reuse counts
• Configure alerting on Apollo Router resource consumption thresholds (CPU > 80%, memory > 85%)
• Enable detailed query logging and analyze for patterns involving multiple references to the same named fragments
• Deploy Web Application Firewall (WAF) rules to detect and block queries with excessive fragment nesting

Monitoring Recommendations

• Monitor Apollo Router health endpoints and establish baseline performance metrics
• Track query validation duration as an early indicator of exploitation attempts
• Implement rate limiting on GraphQL endpoints to reduce the impact of sustained attacks
• Review Apollo Router logs for rejected or timed-out queries that may indicate malicious activity

How to Mitigate CVE-2025-32380

Immediate Actions Required

• Upgrade Apollo Router Core to version 1.61.2 or 2.1.1 immediately
• If immediate upgrade is not possible, implement query depth and complexity limits at the application layer
• Enable rate limiting on GraphQL endpoints to reduce exposure
• Monitor router resource consumption for signs of active exploitation

Patch Information

Apollo has remediated this vulnerability by updating Apollo Router's usage of Apollo Compiler so that validation logic processes each named fragment only once, preventing redundant traversal. The fix is available in the following versions:

• Apollo Router Core 1.61.2 for the 1.x release line
• Apollo Router Core 2.1.1 for the 2.x release line

For technical details, refer to the GitHub Security Advisory GHSA-3j43-9v8v-cp3f. The specific fixes can be reviewed in commits ab6675a631747 and bba032e183b8.

Workarounds

• Implement strict query depth limits using Apollo Router configuration or a GraphQL gateway layer
• Configure maximum query complexity thresholds to reject overly complex queries before validation
• Deploy a reverse proxy with request size and timeout limits in front of Apollo Router
• Consider temporarily blocking or sanitizing queries containing named fragments until patching is complete

# Apollo Router configuration example for query limits
# Add to router.yaml configuration file
limits:
  max_depth: 15
  max_height: 200
  max_aliases: 30
  max_root_fields: 20