Apollo Compiler Excessive Resource Consumption Vulnerability via Named Fragment Processing

A denial-of-service vulnerability has been identified in the Apollo Compiler for GraphQL, affecting versions prior to 1.27.0. The issue arises from the query validation process, where named fragments are sometimes processed multiple times for each fragment spread. This behavior can lead to exponential resource consumption, particularly with deeply nested and reused fragments, causing excessive load and potential service disruption in applications.

Impact

Exploitation of this vulnerability can result in excessive resource consumption, leading to a denial-of-service condition in applications using the affected version of Apollo Compiler.

Remediation

Users can upgrade to Apollo Compiler version 1.27.0 or later to address this vulnerability.