CVE-2024-28101 Apollo Router's Compressed Payloads do not respect HTTP Payload Limits
Attackers can cause denial of service in Apollo Router by sending highly compressed payloads that bypass memory limits during decompression.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-28101?
CVE-2024-28101 is a high-severity denial of service vulnerability in apollographql router, published on 6 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Apollo Router is a graph router written in Rust to run a federated supergraph that uses Apollo Federation. Versions 0.9.5 until 1.40.2 are subject to a Denial-of-Service (DoS) type vulnerability. When receiving compressed HTTP payloads, affected versions of the Router evaluate the `limits.http_max_request_bytes` configuration option after the entirety of the compressed payload is decompressed. If affected versions of the Router receive highly compressed payloads, this could result in significant memory consumption while the compressed payload is expanded. Router version 1.40.2 has a fix for the vulnerability. Those who are unable to upgrade may be able to implement mitigations at proxies or load balancers positioned in front of their Router fleet (e.g. Nginx, HAProxy, or cloud-native WAF services) by creating limits on HTTP body upload size.
Weakness: CWE-409
Which versions are affected by CVE-2024-28101?
2 open source packages ship an affected version, including apollo-router. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
apollo-router crates.io | From 0.9.5 | 1.40.2 |
apollo-router crates.io | From 0.9.5 | 1.40.2 |
Products include Apollographql Apollo Router.
How do I fix CVE-2024-28101?
Upgrade apollo-router to 1.40.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-28101 being exploited?
There is no known exploitation of CVE-2024-28101 in the wild and no public exploit code.
Other vulnerabilities in apollographql router
Sources
Also known as GHSA-cgqf-3cq5-wvcj.