CVE-2025-32033

Executive Summary

CVE-2025-32033 is a high-severity vulnerability in the Apollo Router Core, a high-performance graph router written in Rust for federated supergraphs using Apollo Federation 2. The flaw resides in the operation limits plugin, which uses unsigned 32-bit integers to track query height and other limit counters. When a counter exceeds the maximum value of 4,294,967,295, it wraps around to zero, allowing an attacker to bypass configured thresholds. This can be triggered by large queries with increased payload limits or by small queries with deeply nested and reused named fragments. The vulnerability has been remediated in versions 1.61.2 and 2.1.1. The EPSS score is 0.0%, indicating no active exploitation in the wild, but the potential for bypassing security controls makes it critical to patch.

Supply Chain & Package Security

The Apollo Router is distributed as a Rust binary via GitHub releases and container images. There is no direct NPM, PyPI, Go, or Ruby package involved, but the router is often deployed in containerized environments. Organizations should verify the integrity of downloaded binaries using checksums and sign the container images. The vulnerability is in the core Rust code, not in a third-party dependency, so supply chain risk is limited to the distribution channel.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: Low

The vulnerability allows an attacker to bypass operation limits, potentially leading to denial of service or resource exhaustion. The integrity impact is low because the attacker can only bypass limits, not modify data. The availability impact is low because the bypass may allow resource exhaustion but not a full crash.

Deep Dive & Mechanics

The Apollo Router's operation limits plugin is designed to enforce constraints on GraphQL queries, such as maximum query height, depth, and number of fields. These limits are tracked using unsigned 32-bit integers (u32). In Rust, when a u32 overflows, it wraps around to zero in debug mode (by default) or panics in release mode if overflow checks are enabled. However, the Apollo Router likely uses wrapping arithmetic for performance, causing the counter to reset to zero after reaching 4,294,967,295.

An attacker can craft a query that increments the counter beyond this limit. For example, a deeply nested query with reused named fragments can cause the height counter to wrap. Once the counter wraps, the query appears to have a height of zero, bypassing the configured threshold. This allows the attacker to execute queries that should have been blocked, potentially leading to resource exhaustion or denial of service.

The vulnerability is specific to the operation limits plugin and does not affect other parts of the router. The fix in versions 1.61.2 and 2.1.1 likely uses larger integer types (e.g., u64) or implements saturation arithmetic to prevent wrapping.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: uses u32 for counter
let mut height: u32 = 0;
for node in query_nodes {
    height += 1;
    if height > max_height {
        return Err("Query too deep");
    }
}
// If height wraps to 0, the check is bypassed

Patched Code (Conceptual):

// Patched: uses u64 for counter
let mut height: u64 = 0;
for node in query_nodes {
    height += 1;
    if height > max_height as u64 {
        return Err("Query too deep");
    }
}
// No overflow possible with u64 for practical queries

The patched version uses a larger integer type (u64) to prevent overflow. Alternatively, the fix may use saturating_add to clamp the value at the maximum.

Exploitation & Lab Setup

Red Team

To exploit CVE-2025-32033, an attacker needs to send a GraphQL query that causes the height counter to wrap. This can be achieved by crafting a query with deeply nested fragments that are reused many times. For example:

fragment A on Query { field1 { ...B } }
fragment B on Query { field2 { ...A } }
query {
  ...A
  ...A
  ...A
  # Repeat many times to cause overflow
}

The attacker must also ensure the payload limit is sufficiently high to allow the large query. If the default payload limit is low, the attacker may need to increase it via configuration or find a way to bypass it.

Lab Setup:

1. Deploy an Apollo Router version 1.61.1 or 2.1.0 with default operation limits.
2. Set the payload limit to a high value (e.g., 10 MB) to allow large queries.
3. Send the crafted query using a tool like curl or graphql-client.
4. Observe that the query bypasses the height limit.

Blue Team

To detect exploitation attempts, monitor for queries with excessive nesting or fragment reuse. Use the following detection rules:

• Log Analysis: Look for queries with a high number of fragment spreads or deep nesting.
• Rate Limiting: Implement rate limiting on the number of fragments per query.
• Anomaly Detection: Alert on queries that exceed typical complexity metrics.

Indicators of Compromise (IOCs)

• Network: GraphQL queries with deeply nested fragments (depth > 1000) or excessive fragment reuse.
• Logs: Router logs showing queries that bypass operation limits (e.g., height counter reset).
• System: High CPU or memory usage due to resource exhaustion from bypassed limits.

Detection Engineering

YARA Rule

rule CVE_2025_32033_Apollo_Router_Overflow {
    meta:
        description = "Detects queries that may cause u32 overflow in Apollo Router operation limits"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2025-32033"
    strings:
        $fragment = "fragment" nocase
        $query = "query" nocase
        $reuse = /\.\.\.\w+/  // fragment spread
    condition:
        #reuse > 1000 and $fragment and $query
}

Sigma Rule

title: Apollo Router Operation Limit Bypass via Integer Overflow
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects GraphQL queries with excessive fragment reuse that may trigger u32 overflow in Apollo Router
author: Valters IT
date: 2025-04-17
logsource:
    category: application
    product: apollo_router
detection:
    selection:
        query|contains: "fragment"
        query|re: "(\\.\\.\\.\\w+).*\\1"  # repeated fragment spreads
    condition: selection
falsepositives:
    - Legitimate complex queries with many fragments
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-32033 Apollo Router Operation Limit Bypass"; flow:to_server; content:"fragment"; http_client_body; pcre:"/(\\.\\.\\.\\w+).*\\1/i"; threshold: type both, track by_src, count 10, seconds 60; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade to Apollo Router version 1.61.2 or 2.1.1.
2. Workaround: If upgrading is not possible, reduce the payload limit to prevent large queries from being sent.
3. Configuration: Set conservative operation limits (e.g., max height = 100) to reduce the risk of overflow.
4. Monitoring: Enable logging of operation limit violations and alert on anomalies.
5. Network: Use a Web Application Firewall (WAF) to block queries with excessive fragment reuse.

Valters IT
Securing the digital frontier, one CVE at a time.