Apollo Gateway Excessive Resource Consumption Vulnerability via Named Fragment Expansion

A denial-of-service vulnerability has been identified in Apollo Gateway versions prior to 2.10.1. This issue arises from the query planning process, where deeply nested and reused named fragments are expanded multiple times, leading to exponential resource consumption. As a result, certain query patterns can cause excessive resource usage, rendering the gateway inoperable.

Impact

Exploitation of this vulnerability can lead to excessive resource consumption, causing the Apollo Gateway to become inoperable.

Remediation

Users can upgrade to Apollo Gateway version 2.10.1 or later to address this vulnerability.