Resource exhaustion in Apollographql Apollo Gateway
CVE-2025-32030
Apollo Gateway provides utilities for combining multiple GraphQL microservices into a single GraphQL endpoint. Prior to 2.10.1, a vulnerability in Apollo Gateway allowed queries with deeply nested and reused named fragments to be prohibitively expensive to query plan, specifically during named fragment expansion. Named fragments were being expanded once per fragment spread during query planning, leading to exponential resource usage when deeply nested and reused fragments were involved. This could lead to excessive resource consumption and denial of service. This has been remediated in @apollo/gateway version 2.10.1.
EPSS: 0.005 (39.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Apollographql Apollo_gateway
- Apollographql Federation — versions < 2.10.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC, Issue Tracking)
- security-advisories@github.com (x_refsource_MISC, Release Notes)
Frequently asked questions
- What is CVE-2025-32030?
- CVE-2025-32030 is a high-severity vulnerability in Apollographql Apollo Gateway, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 7.5/10. Published 2025-04-07.
- How severe is CVE-2025-32030?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2025-32030 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.