CVE-2025-32030: Apollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion
(updated )
A vulnerability in Apollo Gateway allowed queries with deeply nested and reused named fragments to be prohibitively expensive to query plan, specifically during named fragment expansion. This could lead to excessive resource consumption and denial of service.
References
- github.com/advisories/GHSA-q2f9-x4p4-7xmh
- github.com/apollographql/federation
- github.com/apollographql/federation/pull/3236
- github.com/apollographql/federation/releases/tag/%40apollo%2Fgateway%402.10.1
- github.com/apollographql/federation/security/advisories/GHSA-q2f9-x4p4-7xmh
- nvd.nist.gov/vuln/detail/CVE-2025-32030
Code Behaviors & Features
Detect and mitigate CVE-2025-32030 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →