Excessive Resource Consumption in Apollo Gateway due to Nested Queries

CVE-2025-32031

What is CVE-2025-32031?

Apollo Gateway, a tool for merging multiple GraphQL microservices into a single GraphQL endpoint, has a vulnerability that could lead to excessive resource consumption. This issue arises when queries include deeply nested and reused named fragments, making them extremely costly to process. The gateway's query planner has optimizations intended to improve efficiency; however, certain complex queries can bypass these optimizations, resulting in significantly increased planning times. Without enforced timeouts, even a few such queries may cause the gateway to become inoperable, potentially leading to service disruptions. This problem has been addressed in Apollo Gateway version 2.10.1.

References