apollographql router up to 1.61.1/2.1.0 memory corruption

Summaryinfo

A vulnerability identified as critical has been detected in apollographql router up to 1.61.1/2.1.0. This issue affects some unknown processing. The manipulation leads to memory corruption. This vulnerability is referenced as CVE-2025-32033. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in apollographql router up to 1.61.1/2.1.0. This issue affects some unknown functionality. The manipulation with an unknown input leads to a memory corruption vulnerability. Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. Impacted is availability. The summary by CVE is:

The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Prior to 1.61.2 and 2.1.1, the operation limits plugin uses unsigned 32-bit integers to track limit counters (e.g. for a query's height). If a counter exceeded the maximum value for this data type (4,294,967,295), it wrapped around to 0, unintentionally allowing queries to bypass configured thresholds. This could occur for large queries if the payload limit were sufficiently increased, but could also occur for small queries with deeply nested and reused named fragments. This has been remediated in apollo-router versions 1.61.2 and 2.1.1.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2025-32033 since 04/01/2025. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available.

Upgrading to version 1.61.2 or 2.1.1 eliminates this vulnerability. Applying the patch ab6675a63174715ea6ff50881fc957831d4e9564 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Router Operating System

Vendor

• apollographql

Name

• router

Version

• 1.61.0
• 1.61.1
• 2.0
• 2.1.0

License

• open-source

Website

• Product: https://github.com/apollographql/router/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion