Vulnerability · Published Apr 7, 2025 · Assigned by GitHub_M

CVE-2025-31496apollo-compiler Named Fragment Processing Vulnerability

High 7.5

In plain English

A high-severity resource allocation without limits in apollo-rs from apollographql. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.4%top 61.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

apollo-compiler is a query-based compiler for the GraphQL query language. Prior to 1.27.0, a vulnerability in Apollo Compiler allowed queries with deeply nested and reused named fragments to be prohibitively expensive to validate. Named fragments were being processed once per fragment spread in some cases during query validation, leading to exponential resource usage when deeply nested and reused fragments were involved. This could lead to excessive resource consumption and denial of service in applications. This vulnerability is fixed in 1.27.0.

Affected products (as reported)

Vendor	Product	Versions
apollographql	apollo-rs	< 1.27.0

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/apollographql/apollo-rs/security/advisories/GHSA-7mpv-9xg6-5r79 x_refsource_CONFIRM
https://github.com/apollographql/apollo-rs/pull/952 x_refsource_MISC