CVE-2024-28101

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-28101", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-03-04T14:19:14.058Z", "datePublished": "2024-03-06T21:07:36.476Z", "dateUpdated": "2024-08-05T16:57:05.215Z"}, "containers": {"cna": {"title": "Apollo Router's Compressed Payloads do not respect HTTP Payload Limits", "problemTypes": [{"descriptions": [{"cweId": "CWE-409", "lang": "en", "description": "CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/apollographql/router/security/advisories/GHSA-cgqf-3cq5-wvcj", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/apollographql/router/security/advisories/GHSA-cgqf-3cq5-wvcj"}, {"name": "https://github.com/apollographql/router/commit/9e9527c73c8f34fc8438b09066163cd42520f413", "tags": ["x_refsource_MISC"], "url": "https://github.com/apollographql/router/commit/9e9527c73c8f34fc8438b09066163cd42520f413"}], "affected": [{"vendor": "apollographql", "product": "router", "versions": [{"version": ">= 0.9.5, < 1.40.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-03-06T21:07:36.476Z"}, "descriptions": [{"lang": "en", "value": "The Apollo Router is a graph router written in Rust to run a federated supergraph that uses Apollo Federation. Versions 0.9.5 until 1.40.2 are subject to a Denial-of-Service (DoS) type vulnerability. When receiving compressed HTTP payloads, affected versions of the Router evaluate the `limits.http_max_request_bytes` configuration option after the entirety of the compressed payload is decompressed. If affected versions of the Router receive highly compressed payloads, this could result in significant memory consumption while the compressed payload is expanded. Router version 1.40.2 has a fix for the vulnerability. Those who are unable to upgrade may be able to implement mitigations at proxies or load balancers positioned in front of their Router fleet (e.g. Nginx, HAProxy, or cloud-native WAF services) by creating limits on HTTP body upload size. \n"}], "source": {"advisory": "GHSA-cgqf-3cq5-wvcj", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:48:48.997Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/apollographql/router/security/advisories/GHSA-cgqf-3cq5-wvcj", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/apollographql/router/security/advisories/GHSA-cgqf-3cq5-wvcj"}, {"name": "https://github.com/apollographql/router/commit/9e9527c73c8f34fc8438b09066163cd42520f413", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/apollographql/router/commit/9e9527c73c8f34fc8438b09066163cd42520f413"}]}, {"affected": [{"vendor": "apollographql", "product": "apollo_router", "cpes": ["cpe:2.3:a:apollographql:apollo_router:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0.9.5", "status": "affected", "lessThan": "1.40.2", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-05T16:54:18.252100Z", "id": "CVE-2024-28101", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-05T16:57:05.215Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/apollographql/router/security/advisories/GHSA-cgqf-3cq5-wvcj", "name": "https://github.com/apollographql/router/security/advisories/GHSA-cgqf-3cq5-wvcj", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/apollographql/router/commit/9e9527c73c8f34fc8438b09066163cd42520f413", "name": "https://github.com/apollographql/router/commit/9e9527c73c8f34fc8438b09066163cd42520f413", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:48:48.997Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-28101", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-05T16:54:18.252100Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:apollographql:apollo_router:*:*:*:*:*:*:*:*"], "vendor": "apollographql", "product": "apollo_router", "versions": [{"status": "affected", "version": "0.9.5", "lessThan": "1.40.2", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-05T16:56:54.988Z"}}], "cna": {"title": "Apollo Router's Compressed Payloads do not respect HTTP Payload Limits", "source": {"advisory": "GHSA-cgqf-3cq5-wvcj", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "apollographql", "product": "router", "versions": [{"status": "affected", "version": ">= 0.9.5, < 1.40.2"}]}], "references": [{"url": "https://github.com/apollographql/router/security/advisories/GHSA-cgqf-3cq5-wvcj", "name": "https://github.com/apollographql/router/security/advisories/GHSA-cgqf-3cq5-wvcj", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/apollographql/router/commit/9e9527c73c8f34fc8438b09066163cd42520f413", "name": "https://github.com/apollographql/router/commit/9e9527c73c8f34fc8438b09066163cd42520f413", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "The Apollo Router is a graph router written in Rust to run a federated supergraph that uses Apollo Federation. Versions 0.9.5 until 1.40.2 are subject to a Denial-of-Service (DoS) type vulnerability. When receiving compressed HTTP payloads, affected versions of the Router evaluate the `limits.http_max_request_bytes` configuration option after the entirety of the compressed payload is decompressed. If affected versions of the Router receive highly compressed payloads, this could result in significant memory consumption while the compressed payload is expanded. Router version 1.40.2 has a fix for the vulnerability. Those who are unable to upgrade may be able to implement mitigations at proxies or load balancers positioned in front of their Router fleet (e.g. Nginx, HAProxy, or cloud-native WAF services) by creating limits on HTTP body upload size. \n"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-409", "description": "CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-03-06T21:07:36.476Z"}}}, "cveMetadata": {"cveId": "CVE-2024-28101", "state": "PUBLISHED", "dateUpdated": "2024-08-05T16:57:05.215Z", "dateReserved": "2024-03-04T14:19:14.058Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-03-06T21:07:36.476Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "router", "vendor": "apollographql", "versions": [{"status": "affected", "version": ">= 0.9.5, < 1.40.2"}]}], "source": "security-advisories@github.com"}, {"affectedData": [{"cpes": ["cpe:2.3:a:apollographql:apollo_router:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "apollo_router", "vendor": "apollographql", "versions": [{"lessThan": "1.40.2", "status": "affected", "version": "0.9.5", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apollographql:apollo_router:*:*:*:*:-:*:*:*", "matchCriteriaId": "46BC9704-41E2-4B8A-B0FB-B31177DD597A", "versionEndExcluding": "1.40.2", "versionStartIncluding": "0.9.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Apollo Router is a graph router written in Rust to run a federated supergraph that uses Apollo Federation. Versions 0.9.5 until 1.40.2 are subject to a Denial-of-Service (DoS) type vulnerability. When receiving compressed HTTP payloads, affected versions of the Router evaluate the `limits.http_max_request_bytes` configuration option after the entirety of the compressed payload is decompressed. If affected versions of the Router receive highly compressed payloads, this could result in significant memory consumption while the compressed payload is expanded. Router version 1.40.2 has a fix for the vulnerability. Those who are unable to upgrade may be able to implement mitigations at proxies or load balancers positioned in front of their Router fleet (e.g. Nginx, HAProxy, or cloud-native WAF services) by creating limits on HTTP body upload size. \n"}, {"lang": "es", "value": "Apollo Router es un router de gr\u00e1ficos escrito en Rust para ejecutar un supergrafo federado que utiliza Apollo Federation. Las versiones 0.9.5 hasta 1.40.2 est\u00e1n sujetas a una vulnerabilidad de tipo Denegaci\u00f3n de servicio (DoS). Al recibir payloads HTTP comprimidos, las versiones afectadas del router eval\u00faan la opci\u00f3n de configuraci\u00f3n `limits.http_max_request_bytes` despu\u00e9s de descomprimir el payload comprimido en su totalidad. Si las versiones afectadas del router reciben payloads altamente comprimidos, esto podr\u00eda resultar en un consumo significativo de memoria mientras se expande el payload comprimido. La versi\u00f3n 1.40.2 del router tiene una soluci\u00f3n para la vulnerabilidad. Aquellos que no puedan actualizar pueden implementar mitigaciones en servidores proxy o balanceadores de carga ubicados frente a su flota de router (por ejemplo, Nginx, HAProxy o servicios WAF nativos de la nube) creando l\u00edmites en el tama\u00f1o de carga del cuerpo HTTP."}], "id": "CVE-2024-28101", "lastModified": "2026-06-17T07:20:58.287", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-28101", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-08-05T16:54:18.252100Z", "version": "2.0.3"}}]}, "published": "2024-03-21T02:52:23.290", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/apollographql/router/commit/9e9527c73c8f34fc8438b09066163cd42520f413"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/apollographql/router/security/advisories/GHSA-cgqf-3cq5-wvcj"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/apollographql/router/commit/9e9527c73c8f34fc8438b09066163cd42520f413"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://github.com/apollographql/router/security/advisories/GHSA-cgqf-3cq5-wvcj"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-409"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{}