CVE-2026-75005: Apache APISIX DOS Vulnerability

CVE-2026-75005 Overview

CVE-2026-75005 is an inefficient algorithmic complexity vulnerability [CWE-407] in Apache APISIX, an open-source API gateway. The flaw exists in the graphql-limit-count plugin used on protected routes. A single small unauthenticated request can pin a gateway worker process at 100% CPU for an extended period. Repeated requests can exhaust worker capacity and degrade service availability for legitimate traffic. The issue affects Apache APISIX version 3.17.0. The Apache APISIX project has released version 3.18.0 to address the vulnerability.

Critical Impact
A single unauthenticated network request against a graphql-limit-count route can consume 100% CPU on a gateway worker, enabling remote denial of service against the API gateway.

Affected Products

Apache APISIX 3.17.0
Routes configured with the graphql-limit-count plugin
Deployments exposing GraphQL endpoints through APISIX

Discovery Timeline

2026-08-27 - CVE-2026-75005 published to the National Vulnerability Database
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-75005

Vulnerability Analysis

CVE-2026-75005 is an algorithmic complexity flaw in the graphql-limit-count plugin of Apache APISIX. The plugin evaluates incoming GraphQL requests to enforce per-operation rate limits. Under specific input conditions, the request-parsing or counting logic performs work that scales disproportionately with request content. A small, well-formed request is sufficient to trigger this expensive processing path.

When the path executes, the affected worker consumes 100% of a CPU core for an extended period. Because Apache APISIX handles requests in a fixed pool of NGINX worker processes, sustained saturation of one or more workers reduces the gateway's ability to serve legitimate traffic. An attacker can amplify impact by issuing multiple parallel requests to exhaust all available workers.

Root Cause

The root cause is inefficient algorithmic complexity in the graphql-limit-count plugin logic. The plugin does not bound the cost of processing untrusted GraphQL input before applying rate-count enforcement. This mirrors the CWE-407 pattern in which computational work is not proportional to input size. Fixed logic ships in Apache APISIX 3.18.0. See the Apache Thread Discussion for maintainer details.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted small request to any route that has the graphql-limit-count plugin enabled. The worker processing the request stalls at 100% CPU. Repeated requests fan out across workers and starve the gateway of processing capacity. The vulnerability does not affect confidentiality or integrity; the exposure is loss of availability. No public proof-of-concept exploit is currently listed for CVE-2026-75005.

No verified exploitation code is available. Refer to the maintainer discussion linked in the Apache Thread Discussion for technical context.

Detection Methods for CVE-2026-75005

Indicators of Compromise

Sustained 100% CPU utilization on one or more Apache APISIX NGINX worker processes without a corresponding increase in request volume.
Elevated request latency or timeouts on routes configured with the graphql-limit-count plugin.
Repeated small HTTP POST requests to GraphQL endpoints from a limited set of source IP addresses.
Health-check failures or upstream errors originating from the APISIX gateway rather than backend services.

Detection Strategies

Enumerate routes that reference the graphql-limit-count plugin and treat them as high-priority monitoring targets.
Correlate APISIX access logs with worker CPU metrics to identify request patterns that precede CPU saturation.
Alert on anomalous per-request CPU time or processing duration on GraphQL routes compared to a historical baseline.

Monitoring Recommendations

Export APISIX Prometheus metrics and monitor apisix_http_latency and worker CPU counters continuously.
Enable request-body logging on GraphQL routes to preserve forensic evidence of triggering payloads.
Configure alerting when worker CPU exceeds a defined threshold for longer than a short sustained window.

How to Mitigate CVE-2026-75005

Immediate Actions Required

Upgrade Apache APISIX from 3.17.0 to 3.18.0, which contains the fix for CVE-2026-75005.
Inventory all routes that enable the graphql-limit-count plugin and prioritize them for patching.
Apply upstream rate limiting or a Web Application Firewall in front of APISIX to constrain request rates against GraphQL endpoints until patching is complete.
Restrict access to GraphQL routes to authenticated clients where feasible.

Patch Information

The Apache APISIX project fixed CVE-2026-75005 in version 3.18.0. Operators running 3.17.0 should upgrade to 3.18.0 or later. Details are published in the Apache Thread Discussion.

Workarounds

Temporarily disable the graphql-limit-count plugin on affected routes until the upgrade is complete.
Enforce request size and rate limits at an upstream proxy or WAF to reduce the impact of triggering requests.
Increase the NGINX worker process count as a short-term buffer, understanding this does not remove the underlying vulnerability.

bash

# Configuration example: identify routes using graphql-limit-count
curl -s http://127.0.0.1:9180/apisix/admin/routes \
  -H 'X-API-KEY: <admin-key>' \
  | jq '.list[] | select(.value.plugins["graphql-limit-count"]) | .value.id'

# Upgrade path
# 1. Back up etcd configuration store
# 2. Deploy Apache APISIX 3.18.0
# 3. Validate route configurations post-upgrade