GHSA-84m6-5m72-45fp CVE-2025-32033
Apollo Router Operation Limits Vulnerable to Bypass via Integer Overflow
- Severity
- 7.5 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 0.60%
- Chance of exploitation in the next 30 days. Higher than 48.52% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-190 Integer Overflow or Wraparound
- Fix
1.61.2- Upgrade apollo-router to this version or later
Description
Impact
Summary
A vulnerability in Apollo Router allowed certain queries to bypass configured operation limits, specifically due to integer overflow.
Details
The operation limits plugin uses unsigned 32-bit integers to track limit counters (e.g. for a query's height). If a counter exceeded the maximum value for this data type (4,294,967,295), it wrapped around to 0, unintentionally allowing queries to bypass configured thresholds. This could occur for large queries if the payload limit were sufficiently increased, but could also occur for small queries with deeply nested and reused named fragments.
Fix/Mitigation
Logic was updated to ensure counter overflow is handled correctly and does not wrap around to 0.
Patches
This has been remediated in apollo-router versions 1.61.2 and 2.1.1.
Workarounds
The only known workaround is "Safelisting" or "Safelisting with IDs only" per Safelisting with Persisted Queries - Apollo GraphQL Docs.
Acknowledgements
We appreciate the efforts of the security community in identifying and improving the performance and security of operation limiting mechanisms.
Affected versions
crates.io
| Package | Vulnerable | Fixed in |
|---|---|---|
| apollo-router | < 1.61.2 |
1.61.2 |
| apollo-router | >= 2.0.0-alpha.0, < 2.1.1 |
2.1.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
apollo-router crates.io → 1.61.2
- cargo
cargo update -p apollo-router --precise 1.61.2
Severity breakdown
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-190: Integer Overflow or Wraparound
The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
How to prevent it
- Requirements: Ensure that all protocols are strictly defined, such that all out-of-bounds behavior can be identified simply, and require strict conformance to the protocol.
- Requirements: Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. If possible, choose a language or compiler that performs automatic bounds checking.
- Architecture and Design: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Use libraries or frameworks that make it easier to handle numbers without unexpected consequences. Examples include safe integer handling packages such as SafeInt (C++) or IntegerLib (C or C++). [REF-106]
- Implementation: Perform input validation on any numeric input by ensuring that it is within the expected range. Enforce that the input meets both the minimum and maximum requirements for the expected range. Use unsigned integers where possible. This makes it easier to perform validation for integer overflows. When signed integers are required, ensure that the range check includes minimum values as well as maximum values.
- Implementation: Understand the programming language's underlying representation and how it interacts with numeric calculation (CWE-681). Pay close attention to byte size discrepancies, precision, signed/unsigned distinctions, truncation, conversion and casting between types, "not-a-number" calculations, and how the language handles numbers that are too large or too small for its underlying representation. [REF-7] Also be careful to account for 32-bit, 64-bit, and other potential differences that may affect the numeric representation.
- Architecture and Design: For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
- Implementation: Examine compiler warnings closely and eliminate problems with potential security implications, such as signed / unsigned mismatch in memory operations, or use of uninitialized variables. Even if the weakness is rarely exploitable, a single failure may lead to the compromise of the entire system.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-hff2-gcpx-8f4p Apollo Router Core: Browser Bug Enables Bypass of XS-Search Prevention via Read-Only Cross-Site Request Forgery | Medium | Also affects apollo-router |
| GHSA-x33c-7c2v-mrj9 Apollo Router Affected by an Access Control Bypass on Polymorphic Types | High | Also affects apollo-router |
| GHSA-g8jh-vg5j-4h3f Apollo Router Improperly Enforces Renamed Access Control Directives | High | Also affects apollo-router |
| GHSA-3j43-9v8v-cp3f Apollo Router Query Validation Vulnerable to Excessive Resource Consumption via Named Fragment Processing | High | Also affects apollo-router |
| GHSA-75m2-jhh5-j5g2 Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion | High | Also affects apollo-router |
| GHSA-94hh-jmq8-2fgp Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass | High | Also affects apollo-router |
| GHSA-x6xq-whh3-gg32 Apollo Router Coprocessors may cause Denial-of-Service when handling request bodies | High | Also affects apollo-router |
| GHSA-fmj9-77q8-g6c4 Apollo Query Planner and Apollo Gateway may infinitely loop on sufficiently complex queries | High | Also affects apollo-router |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor