DoS Vulnerability in Apollo Compiler Affects GraphQL Applications
CVE-2025-31496

7.5HIGH

Key Information:

Vendor

Apollographql

Status
Apollo-rs
Vendor
CVE Published:
7 April 2025

What is CVE-2025-31496?

The Apollo Compiler is a query-based compiler for GraphQL. Before version 1.27.0, it suffered from a vulnerability allowing queries with deeply nested and reused named fragments to consume excessive resources during validation. This issue arises because named fragments are processed multiple times during query validation, particularly in complex queries. As a result, applications may experience significant performance degradation or complete denial of service due to this exponential resource consumption. The problem has been addressed in version 1.27.0.

Affected Version(s)

apollo-rs < 1.27.0

References

https://github.com/apollographql/apollo-rs/security/advis...
x_refsource_CONFIRM
https://github.com/apollographql/apollo-rs/pull/952
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.