CVE-2025-32030: Apollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion
Impact
Summary
A vulnerability in Apollo Gateway allowed queries with deeply nested and reused named fragments to be prohibitively expensive to query plan, specifically during named fragment expansion. This could lead to excessive resource consumption and denial of service.
Details
Named fragments were being expanded once per fragment spread during query planning, leading to exponential resource usage when deeply nested and reused fragments were involved.
Fix/Mitigation
A new Query Fragment Expansion Limit metric has been introduced: - This metric computes the number of selections a query would have if its fragment spreads were fully expanded. - The metric is checked against a limit to prevent excessive computation.
Patches
This has been remediated in @apollo/gateway version 2.10.1.
Workarounds
No known direct workarounds exist.
References
Query Planning Documentation
Acknowledgements
We appreciate the efforts of the security community in identifying and improving the performance and security of query planning mechanisms.
Other sources
Apollo Gateway provides utilities for combining multiple GraphQL microservices into a single GraphQL endpoint. Prior to 2.10.1, a vulnerability in Apollo Gateway allowed queries with deeply nested and reused named fragments to be prohibitively expensive to query plan, specifically during named fragment expansion. Named fragments were being expanded once per fragment spread during query planning, leading to exponential resource usage when deeply nested and reused fragments were involved. This could lead to excessive resource consumption and denial of service. This has been remediated in @apollo/gateway version 2.10.1.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-32030?
The severity of CVE-2025-32030 is categorized based on its potential impact on system performance and availability.
How do I fix CVE-2025-32030?
To fix CVE-2025-32030, upgrade Apollo Gateway to version 2.10.1 or later.
What type of attack does CVE-2025-32030 involve?
CVE-2025-32030 involves performance degradation through expensive query planning due to deeply nested and reused named fragments.
Which versions of Apollo Gateway are affected by CVE-2025-32030?
Versions of Apollo Gateway prior to 2.10.1 are affected by CVE-2025-32030.
Is CVE-2025-32030 easy to exploit?
Exploitation of CVE-2025-32030 could lead to significant resource consumption, affecting the system's performance.