Infinite Loop in Apollo Federation Due to Exhaustive Query Planning

CVE-2024-43414

What is CVE-2024-43414?

Apollo Federation provides a flexible architecture for combining APIs into a cohesive graph, allowing teams to manage their API components independently. However, a vulnerability in the @apollo/query-planner component can lead to denial-of-service (DoS) incidents when an overly complex query is processed. This vulnerability may cause the query planner to enter an infinite loop, consuming unbounded memory and subsequently leading to application crashes or out-of-memory terminations. Specifically, complications arise when certain fields can be resolved from multiple subgraphs, demanding careful schema reviews to identify shared fields. The risk escalates when using versions of @apollo/query-planner, @apollo/gateway, or Apollo Router that fall within specified ranges, necessitating immediate upgrades to mitigate potential impacts.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References