Configuration and Limit Bypass Vulnerability in Apollo Router Core from Apollo GraphQL
CVE-2025-32033
7.5HIGH
What is CVE-2025-32033?
The Apollo Router Core is a high-performance graph routing system designed for federated supergraphs using Apollo Federation 2. Earlier versions, specifically before 1.61.2 and 2.1.1, contained a vulnerability in the operation limits plugin that used unsigned 32-bit integers for tracking limit counters. If these counters exceeded 4,294,967,295, they'd wrap around to 0, allowing queries to bypass set thresholds. This issue could be triggered by large queries or even smaller ones featuring deeply nested named fragments, presenting potential risks in handling data queries.
Affected Version(s)
router < 1.61.2 < 1.61.2
router >= 2.0.0-alpha.0, < 2.1.1 < 2.0.0-alpha.0, 2.1.1