CVE-2025-32031: Apollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass
Impact
Summary
A vulnerability in Apollo Gateway allowed queries with deeply nested and reused named fragments to be prohibitively expensive to query plan, specifically due to internal optimizations being frequently bypassed. This could lead to excessive resource consumption and denial of service.
Details
The query planner includes an optimization that significantly speeds up planning for applicable GraphQL selections. However, queries with deeply nested and reused named fragments can generate many selections where this optimization does not apply, leading to significantly longer planning times. Because the query planner does not enforce a timeout, a small number of such queries can render gateway inoperable.
Fix/Mitigation
- A new Query Optimization Limit metric has been added: - This metric approximates the number of selections that cannot be skipped by the existing optimization. - The metric is checked against a limit to prevent excessive computation.
Given the complexity of query planning optimizations, we will continue refining these solutions based on real-world performance and accuracy tests.
Patches
This has been remediated in @apollo/gateway version 2.10.1.
Workarounds
No known direct workarounds exist.
References
Query Planning Documentation
Acknowledgements
We appreciate the efforts of the security community in identifying and improving the performance and security of query planning mechanisms.
Other sources
Apollo Gateway provides utilities for combining multiple GraphQL microservices into a single GraphQL endpoint. Prior to 2.10.1, a vulnerability in Apollo Gateway allowed queries with deeply nested and reused named fragments to be prohibitively expensive to query plan, specifically due to internal optimizations being frequently bypassed. The query planner includes an optimization that significantly speeds up planning for applicable GraphQL selections. However, queries with deeply nested and reused named fragments can generate many selections where this optimization does not apply, leading to significantly longer planning times. Because the query planner does not enforce a timeout, a small number of such queries can render gateway inoperable. This could lead to excessive resource consumption and denial of service. This has been remediated in @apollo/gateway version 2.10.1.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-32031?
CVE-2025-32031 is considered a moderate severity vulnerability due to its potential impact on query performance.
How do I fix CVE-2025-32031?
To fix CVE-2025-32031, upgrade Apollo Gateway to version 2.10.1 or later.
What types of applications are affected by CVE-2025-32031?
CVE-2025-32031 affects applications that use Apollo Gateway for combining multiple GraphQL microservices.
What specific issue does CVE-2025-32031 address?
CVE-2025-32031 addresses a vulnerability that allows deeply nested and reused named fragments to create expensive query planning operations.
Has CVE-2025-32031 been publicly disclosed?
Yes, CVE-2025-32031 has been publicly disclosed in the context of security advisories.