Vulnerability Database
289,697
Total vulnerabilities in the database
CVE-2023-45812
The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability which causes the Router to panic and terminate when a multi-part response is sent. When users send queries to the router that uses the @defer or Subscriptions, the Router will panic. To be vulnerable, users of Router must have a coprocessor with coprocessor.supergraph.response configured in their router.yaml and also to support either @defer or Subscriptions. Apollo Router version 1.33.0 has a fix for this vulnerability which was introduced in PR #4014. Users are advised to upgrade. Users unable to upgrade should avoid using the coprocessor supergraph response or disable defer and subscriptions support and continue to use the coprocessor supergraph response.
| Software | From | Fixed in |
|---|---|---|
apollo-router
|
1.31.0 | 1.33.0 |
| apollographql / apollo_router | 1.31.0 | 1.32.0.x |
| apollographql / apollo_helms-charts_router | 1.31.0 | 1.32.0.x |