Vulnerability in Apollographql Router
CVE-2024-32971
Apollo Router is a configurable, graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. The affected versions of Apollo Router contain a bug that in limited circumstances, could lead to unexpected operati…
EPSS: 0.002 (43.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Apollographql Router — versions >=1.44.0, <1.45.1
Weakness classification (CWE)
References
- https://github.com/apollographql/router/security/advisories/GHSA-q9p4-hw9m-fj2v (x_refsource_CONFIRM)
- https://github.com/apollographql/router/commit/ff9f666598cd17661880fe7fc6e9c9611316e529 (x_refsource_MISC)
- https://github.com/apollographql/router/releases/tag/v1.45.1 (x_refsource_MISC)
- https://www.apollographql.com/docs/router/configuration/distributed-caching/#distributed-query-plan-caching (x_refsource_MISC)
Frequently asked questions
- What is CVE-2024-32971?
- CVE-2024-32971 is a critical-severity vulnerability in Apollographql Router, classified under Always-Incorrect Control Flow Implementation. CVSS score: 9.1/10. Published 2024-05-02.
- How severe is CVE-2024-32971?
- Critical severity. CVSS v3 base score is 9.1 out of 10.