CVE-2025-32031: Apollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass

Published Apr 7, 2025
·
Updated

Impact

Summary

A vulnerability in Apollo Gateway allowed queries with deeply nested and reused named fragments to be prohibitively expensive to query plan, specifically due to internal optimizations being frequently bypassed. This could lead to excessive resource consumption and denial of service.

Details

The query planner includes an optimization that significantly speeds up planning for applicable GraphQL selections. However, queries with deeply nested and reused named fragments can generate many selections where this optimization does not apply, leading to significantly longer planning times. Because the query planner does not enforce a timeout, a small number of such queries can render gateway inoperable.

Fix/Mitigation

- A new Query Optimization Limit metric has been added: - This metric approximates the number of selections that cannot be skipped by the existing optimization. - The metric is checked against a limit to prevent excessive computation.

Given the complexity of query planning optimizations, we will continue refining these solutions based on real-world performance and accuracy tests.

Patches

This has been remediated in @apollo/gateway version 2.10.1.

Workarounds

No known direct workarounds exist.

References

Query Planning Documentation

Acknowledgements

We appreciate the efforts of the security community in identifying and improving the performance and security of query planning mechanisms.

Other sources

Apollo Gateway provides utilities for combining multiple GraphQL microservices into a single GraphQL endpoint. Prior to 2.10.1, a vulnerability in Apollo Gateway allowed queries with deeply nested and reused named fragments to be prohibitively expensive to query plan, specifically due to internal optimizations being frequently bypassed. The query planner includes an optimization that significantly speeds up planning for applicable GraphQL selections. However, queries with deeply nested and reused named fragments can generate many selections where this optimization does not apply, leading to significantly longer planning times. Because the query planner does not enforce a timeout, a small number of such queries can render gateway inoperable. This could lead to excessive resource consumption and denial of service. This has been remediated in @apollo/gateway version 2.10.1.

MITRE

Affected Software

3 affected componentsFixes available
Apollo Gateway<2.10.1
npm/@apollo/gateway<2.10.1
2.10.1
apollographql Apollo Gateway Node.js<2.10.1

Event History

Apr 7, 2025
Advisory Published
via GitHub·07:03 PM
CVE Published
via MITRE·08:41 PM
Data Sourced
via MITRE·08:41 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:15 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:15 PM
RemedyAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2025-32031?

CVE-2025-32031 is considered a moderate severity vulnerability due to its potential impact on query performance.

2

How do I fix CVE-2025-32031?

To fix CVE-2025-32031, upgrade Apollo Gateway to version 2.10.1 or later.

3

What types of applications are affected by CVE-2025-32031?

CVE-2025-32031 affects applications that use Apollo Gateway for combining multiple GraphQL microservices.

4

What specific issue does CVE-2025-32031 address?

CVE-2025-32031 addresses a vulnerability that allows deeply nested and reused named fragments to create expensive query planning operations.

5

Has CVE-2025-32031 been publicly disclosed?

Yes, CVE-2025-32031 has been publicly disclosed in the context of security advisories.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203