Most recent entries from all

EUVD-2026-163104

2026-10-09T08:55:20.915651+00:00

EUVD-2026-163104

fkie_cve-2023-45812

2026-10-09T08:55:20.915695+00:00

The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability which causes the Router to panic and terminate when a multi-part response is sent. When users send queries to the router that uses the `@defer` or Subscriptions, the Router will panic. To be vulnerable, users of Router must have a coprocessor with `coprocessor.supergraph.response` configured in their `router.yaml` and also to support either `@defer` or Subscriptions. Apollo Router version 1.33.0 has a fix for this vulnerability which was introduced in PR #4014. Users are advised to upgrade. Users unable to upgrade should avoid using the coprocessor supergraph response or disable defer and subscriptions support and continue to use the coprocessor supergraph response.

GHSA-r344-xw3p-2frj — Apollo Router vulnerable to Improper Check or Handling of Exceptional Conditions

2026-10-09T08:55:20.915735+00:00

Affected: crates.io: apollo-router

### Impact The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability which causes the Router to panic and terminate when a multi-part response is sent. When users send queries to the router that uses the `@defer` or Subscriptions, the Router will panic. To be vulnerable, users of Router must have a coprocessor with `coprocessor.supergraph.response` configured in their `router.yaml` and also to support either `@defer` or Subscriptions.

### Patches Router version 1.33.0 has a fix for this vulnerability. https://github.com/apollographql/router/pull/4014 fixes the issue.

### Workarounds For affected versions, avoid using the coprocessor supergraph response: ```yml # do not use this stage in your coprocessor configuration coprocessor: supergraph: response: ```

Or you can disable defer and subscriptions support: ```yml # disable defer and subscriptions: supergraph: defer_support: false # enabled by default subscription: enabled: false # disabled by default ``` and continue to use the coprocessor supergraph response. ### References https://github.com/apollographql/router/issues/4013

gsd-2023-45812

2026-10-09T08:55:20.915773+00:00

gsd-2023-45812