CVE-2026-94250: Apache APISIX: Batch response aggregation can exhaust worker memory
Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX.
An unauthenticated caller can drive a gateway worker into OOM via a route where the batch-requests plugin is used and the batch endpoint is publicly exposed. This issue affects Apache APISIX: from 1.3.0 through 3.18.0.
Users are recommended to upgrade to version 3.19.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache APISIXto a version that resolves this vulnerability.Fixed in 3.19.0
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated exploitation?
A deployment is exposed when a route uses the batch-requests plugin and its batch endpoint is publicly accessible. An unauthenticated caller can use that endpoint to exhaust the memory of a gateway worker.
What versions need remediation?
Apache APISIX versions from 1.3.0 through 3.18.0 are affected. Upgrade to version 3.19.0 to fix the issue.
What can be done if an immediate upgrade is not possible?
Restrict public access to batch endpoints on routes using the batch-requests plugin. The described attack requires the batch endpoint to be publicly exposed.