{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-27T05:04:20.132","vulnerabilities":[{"cve":{"id":"CVE-2025-32380","sourceIdentifier":"security-advisories@github.com","published":"2025-04-09T16:15:26.053","lastModified":"2026-06-17T09:11:54.567","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. A vulnerability in Apollo Router's usage of Apollo Compiler allowed queries with deeply nested and reused named fragments to be prohibitively expensive to validate. This could lead to excessive resource consumption and denial of service.  Apollo Router's usage of Apollo Compiler has been updated so that validation logic processes each named fragment only once, preventing redundant traversal. This has been remediated in apollo-router versions 1.61.2 and 2.1.1."},{"lang":"es","value":"Apollo Router Core es un enrutador gráfico configurable y de alto rendimiento, escrito en Rust, para ejecutar un supergrafo federado que utiliza Apollo Federation 2. Una vulnerabilidad en el uso del compilador Apollo por parte del enrutador Apollo provocó que la validación de consultas con fragmentos con nombre profundamente anidados y reutilizados fuera prohibitivamente costosa. Esto podría provocar un consumo excesivo de recursos y denegación de servicio. El uso del compilador Apollo por parte del enrutador Apollo se ha actualizado para que la lógica de validación procese cada fragmento con nombre solo una vez, evitando así la navegación redundante. Esto se ha solucionado en las versiones 1.61.2 y 2.1.1 de apollo-router."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"apollographql","product":"router","versions":[{"version":"< 1.61.2","status":"affected"},{"version":">= 2.0.0-alpha.0, < 2.1.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-04-09T17:28:24.099060Z","id":"CVE-2025-32380","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://github.com/apollographql/router/commit/ab6675a63174715ea6ff50881fc957831d4e9564","source":"security-advisories@github.com"},{"url":"https://github.com/apollographql/router/commit/bba032e183b861348a466d3123c7137a1ae18952","source":"security-advisories@github.com"},{"url":"https://github.com/apollographql/router/security/advisories/GHSA-3j43-9v8v-cp3f","source":"security-advisories@github.com"}]}}]}