« Volver al listado

CVE-2025-32031

Estado: AnalizadaAlta (7.5)—

Apollo Gateway provides utilities for combining multiple GraphQL microservices into a single GraphQL endpoint. Prior to 2.10.1, a vulnerability in Apollo Gateway allowed queries with deeply nested and reused named fragments to be prohibitively expensive to query plan, specifically due to internal optimizations being frequently bypassed. The query planner includes an optimization that significantly speeds up planning for applicable GraphQL selections.

Leer descripción completaMostrar menos

However, queries with deeply nested and reused named fragments can generate many selections where this optimization does not apply, leading to significantly longer planning times. Because the query planner does not enforce a timeout, a small number of such queries can render gateway inoperable. This could lead to excessive resource consumption and denial of service. This has been remediated in @apollo/gateway version 2.10.1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad de DoS en servicio GraphQL expuesto en red sin autenticación (AV:N/PR:N). Queries malformadas causan consumo excesivo de recursos (CWE-770) bloqueando el gateway.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Tecnologías afectadas (1)

Apollographql — Apollo Gateway

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-32031",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-32031",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-08T14:39:08.833833Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "apollographql",
          "product": "federation",
          "versions": [
            {
              "status": "affected",
              "version": "< 2.10.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-04-07T21:15:43.220",
  "references": [
    {
      "url": "https://github.com/apollographql/federation/pull/3236",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/apollographql/federation/releases/tag/%40apollo%2Fgateway%402.10.1",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/apollographql/federation/security/advisories/GHSA-p2q6-pwh5-m6jr",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Apollo Gateway provides utilities for combining multiple GraphQL microservices into a single GraphQL endpoint. Prior to 2.10.1, a vulnerability in Apollo Gateway allowed queries with deeply nested and reused named fragments to be prohibitively expensive to query plan, specifically due to internal optimizations being frequently bypassed. The query planner includes an optimization that significantly speeds up planning for applicable GraphQL selections. However, queries with deeply nested and reused named fragments can generate many selections where this optimization does not apply, leading to significantly longer planning times. Because the query planner does not enforce a timeout, a small number of such queries can render gateway inoperable. This could lead to excessive resource consumption and denial of service. This has been remediated in @apollo/gateway version 2.10.1."
    },
    {
      "lang": "es",
      "value": "Apollo Gateway proporciona utilidades para combinar múltiples microservicios GraphQL en un único endpoint GraphQL. Antes de la versión 2.10.1, una vulnerabilidad en Apollo Gateway hacía que la planificación de consultas con fragmentos con nombre profundamente anidados y reutilizados fuera excesivamente costosa, especialmente debido a que las optimizaciones internas se omitían con frecuencia. El planificador de consultas incluye una optimización que acelera significativamente la planificación de las selecciones GraphQL aplicables. Sin embargo, las consultas con fragmentos con nombre profundamente anidados y reutilizados pueden generar muchas selecciones donde esta optimización no aplica, lo que resulta en tiempos de planificación significativamente más largos. Dado que el planificador de consultas no impone un tiempo de espera, un pequeño número de estas consultas puede inutilizar la puerta de enlace. Esto podría provocar un consumo excesivo de recursos y una denegación de servicio. Esto se ha solucionado en la versión 2.10.1 de @apollo/gateway."
    }
  ],
  "lastModified": "2026-06-17T09:11:21.113",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apollographql:apollo_gateway:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "681002C1-DF2D-457E-B545-D775CD90A951",
              "versionEndExcluding": "2.10.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}