{"answers":{"affected":"2 open source packages ship an affected version, including apollo-router. It affects 1 product.","exploited":"There is no known exploitation of CVE-2024-28101 in the wild and no public exploit code.","fix":"Upgrade apollo-router to 1.40.2 or later.","what":"CVE-2024-28101 is a high-severity denial of service vulnerability in apollographql router, published on 6 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2024-28101 and fix it if it is affected.\n\nWhat it is: CVE-2024-28101 is a high-severity denial of service vulnerability in apollographql router, published on 6 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2024-28101 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- apollo-router (crates.io): affected from 0.9.5; fixed in 1.40.2\n- apollo-router (crates.io): affected from 0.9.5; fixed in 1.40.2\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-28101/ (Markdown: https://insights.sbomify.com/CVE-2024-28101/index.md)","id":"CVE-2024-28101","markdown":"https://insights.sbomify.com/CVE-2024-28101/index.md","name":"CVE-2024-28101","record":{"aliases":["GHSA-cgqf-3cq5-wvcj"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Apollo Router","requires_auth":"none","summary":"Attackers can cause denial of service in Apollo Router by sending highly compressed payloads that bypass memory limits during decompression.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"apollo_router","vendor":"apollographql"}],"cvss":{"score":7.5,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-409","name":"Improper Handling of Highly Compressed Data (Data Amplification)"}],"description":"The Apollo Router is a graph router written in Rust to run a federated supergraph that uses Apollo Federation. Versions 0.9.5 until 1.40.2 are subject to a Denial-of-Service (DoS) type vulnerability. When receiving compressed HTTP payloads, affected versions of the Router evaluate the `limits.http_max_request_bytes` configuration option after the entirety of the compressed payload is decompressed. If affected versions of the Router receive highly compressed payloads, this could result in significant memory consumption while the compressed payload is expanded. Router version 1.40.2 has a fix for the vulnerability. Those who are unable to upgrade may be able to implement mitigations at proxies or load balancers positioned in front of their Router fleet (e.g. Nginx, HAProxy, or cloud-native WAF services) by creating limits on HTTP body upload size.","ecosystems":["crates.io"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Apollo Router's Compressed Payloads do not respect HTTP Payload Limits","id":"CVE-2024-28101","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"denial_of_service","year":"2024"},"n_packages":2,"n_references":2,"next":{"headline":"JWCrypto vulnerable to JWT bomb Attack in `deserialize` function","id":"CVE-2024-28102"},"packages":[{"ecosystem":"crates.io","fixed":["1.40.2"],"introduced":["0.9.5"],"last_affected":[],"package":"apollo-router","purl":null,"source":"GHSA-cgqf-3cq5-wvcj"},{"ecosystem":"crates.io","fixed":["1.40.2"],"introduced":["0.9.5"],"last_affected":[],"package":"apollo-router","purl":"pkg:cargo/apollo-router","source":"GHSA-cgqf-3cq5-wvcj"}],"prev":{"headline":"Stored Cross-site Scripting leading to arbitrary actions taken on behalf of users in elabftw","id":"CVE-2024-28100"},"products":["router"],"published":"2024-03-06","related":[{"cvss_score":7.5,"headline":"Unnamed \"Subscription\" operation results in Denial-of-Service in apollographql/router","id":"CVE-2023-41317","kev_date_added":null,"published":"2023-09-05"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2024-08-05","vendors":["apollographql"]},"summary":"Attackers can cause denial of service in Apollo Router by sending highly compressed payloads that bypass memory limits during decompression.","url":"https://insights.sbomify.com/CVE-2024-28101/"}