CVE-2024-28101
📋 TL;DR
The Apollo Router versions 0.9.5 through 1.40.1 have a DoS vulnerability where highly compressed HTTP payloads cause excessive memory consumption during decompression before size limits are enforced. This affects all deployments using these vulnerable versions, potentially allowing attackers to crash or degrade router performance.
💻 Affected Systems
- Apollo Router
📦 What is this software?
Apollo Router by Apollographql
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage due to memory exhaustion, causing router crashes and unavailability of GraphQL services.
Likely Case
Performance degradation and intermittent service disruptions from memory pressure and resource exhaustion.
If Mitigated
Minimal impact with proper request size limits at proxy layers or upgraded router versions.
🎯 Exploit Status
Exploitation requires sending specially crafted compressed HTTP payloads but is straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.40.2
Vendor Advisory: https://github.com/apollographql/router/security/advisories/GHSA-cgqf-3cq5-wvcj
Restart Required: Yes
Instructions:
1. Update Apollo Router to version 1.40.2 or later. 2. Restart the router service. 3. Verify the new version is running.
🔧 Temporary Workarounds
Configure HTTP request size limits at proxy
allImplement request body size limits in frontend proxies like Nginx or HAProxy to block oversized requests before they reach the router.
# Nginx example: client_max_body_size 10m;
# HAProxy example: tune.bufsize 10485760
🧯 If You Can't Patch
- Deploy WAF or proxy layer with strict HTTP body size limits before requests reach vulnerable routers.
- Disable HTTP compression support in router configuration if feasible for your use case.
🔍 How to Verify
Check if Vulnerable:
Check Apollo Router version: if between 0.9.5 and 1.40.1 inclusive, system is vulnerable.Check Version:
apollo-router --versionVerify Fix Applied:
Confirm router version is 1.40.2 or later and test with compressed payloads while monitoring memory usage.📡 Detection & Monitoring
Log Indicators:
- Unusual memory consumption spikes
- Router crash/restart logs
- Large compressed request logs
Network Indicators:
- Large compressed HTTP POST requests to router endpoints
- Abnormal request patterns with high compression ratios
SIEM Query:
source="apollo-router" AND (memory_usage>90% OR "panic" OR "restart")🔗 References
- https://github.com/apollographql/router/commit/9e9527c73c8f34fc8438b09066163cd42520f413
- https://github.com/apollographql/router/security/advisories/GHSA-cgqf-3cq5-wvcj
- https://github.com/apollographql/router/commit/9e9527c73c8f34fc8438b09066163cd42520f413
- https://github.com/apollographql/router/security/advisories/GHSA-cgqf-3cq5-wvcj
