{"cve":"CVE-2023-45812","nvd":{"published":"2023-10-18T22:15:09.403","modified":"2026-06-17T06:29:34.470","status":"Modified","description":"The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability which causes the Router to panic and terminate when a multi-part response is sent. When users send queries to the router that uses the `@defer` or Subscriptions, the Router will panic. To be vulnerable, users of Router must have a coprocessor with `coprocessor.supergraph.response` configured in their `router.yaml` and also to support either `@defer` or Subscriptions. Apollo Router version 1.33.0 has a fix for this vulnerability which was introduced in PR #4014. Users are advised to upgrade. Users unable to upgrade should avoid using the coprocessor supergraph response or disable defer and subscriptions support and continue to use the coprocessor supergraph response.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-754"],"references":["https://github.com/apollographql/router/pull/4014","https://github.com/apollographql/router/security/advisories/GHSA-r344-xw3p-2frj","https://github.com/apollographql/router/pull/4014","https://github.com/apollographql/router/security/advisories/GHSA-r344-xw3p-2frj"],"products":["apollographql:apollo_helms-charts_router","apollographql:apollo_router"],"source":"nvd","synced_at":"2026-10-19T21:40:11.519948003+00:00"},"epss":{"cve":"CVE-2023-45812","score":0.00867,"percentile":0.58747,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-r344-xw3p-2frj","url":"https://osv.dev/vulnerability/GHSA-r344-xw3p-2frj","summary":"Apollo Router vulnerable to Improper Check or Handling of Exceptional Conditions","modified":"2026-09-10T03:49:24.652702634Z","packages":[{"ecosystem":"crates.io","name":"apollo-router","purl":"pkg:cargo/apollo-router","ranges":[">=1.31.0 <1.33.0"],"fixed":["1.33.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}