Skip to content

Apollo Router's Compressed Payloads do not respect HTTP Payload Limits

Moderate severity GitHub Reviewed Published Mar 6, 2024 in apollographql/router • Updated Mar 6, 2024

Package

cargo apollo-router (Rust)

Affected versions

>= 0.9.5, < 1.40.2

Patched versions

1.40.2

Description

Impact

The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability. When receiving compressed HTTP payloads, affected versions of the Router evaluate the limits.http_max_request_bytes configuration option after the entirety of the compressed payload is decompressed. If affected versions of the Router receive highly compressed payloads, this could result in significant memory consumption while the compressed payload is expanded.

Patches

Router version 1.40.2 has a fix for the vulnerability.

Workarounds

If you are unable to upgrade, you may be able to implement mitigations at proxies or load balancers positioned in front of your Router fleet (e.g. Nginx, HAProxy, or cloud-native WAF services) by creating limits on HTTP body upload size.

References

@peakematt peakematt published to apollographql/router Mar 6, 2024
Published to the GitHub Advisory Database Mar 6, 2024
Reviewed Mar 6, 2024
Last updated Mar 6, 2024

Severity

Moderate

EPSS score

0.043%
(10th percentile)

Weaknesses

CVE ID

CVE-2024-28101

GHSA ID

GHSA-cgqf-3cq5-wvcj

Source code

Credits

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.