Improper Check or Handling of Exceptional Conditions in apollo-router

CVE-2023-45812

What is CVE-2023-45812?

The Apollo Router, a high-performance graph router developed in Rust for federated supergraphs, is susceptible to a Denial-of-Service vulnerability. Specifically, certain configurations can lead the Router to panic and unexpectedly terminate when processing multi-part responses that employ the @defer directive or Subscriptions. This vulnerability necessitates that users have a coprocessor configured to support coprocessor.supergraph.response within their router.yaml. To mitigate risks, it is crucial to upgrade to Apollo Router version 1.33.0, where the issue has been resolved. Users unable to perform the upgrade should disable the use of defer and subscriptions or refrain from utilizing the coprocessor supergraph response.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References