CVSS 3.1 Score 7.5 of 10 (high)


Published Mar 21, 2024
CWE ID 409


CVE-2024-28101 is a Denial-of-Service (DoS) vulnerability affecting versions 0.9.5 until 1.40.2 of the Apollo Router, a graph router written in Rust for running a federated supergraph using Apollo Federation. The vulnerability occurs when the Router receives compressed HTTP payloads and evaluates the limits.http_max_request_bytes configuration option after decompressing the payload, leading to excessive memory consumption during expansion. The vulnerability has a high severity rating and an exploitability score of 3.9 out of 10. To remediate this vulnerability, organizations can upgrade to Router version 1.40.2 or implement mitigations at proxies or load balancers positioned in front of their Router fleet by setting limits on HTTP body upload size, using tools like Nginx, HAProxy, or cloud-native WAF services.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2024-28101 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options