How many apollographql apollo-router CVEs are in CISA KEV?

None of apollographql apollo-router's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which versions of apollographql apollo-router are affected?

19 distinct apollographql apollo-router versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in apollographql apollo-router CVEs?

apollographql apollo-router's CVEs most often map to these CWE weakness types: CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-284 (Improper Access Control), CWE-288 (Authentication Bypass Using an Alternate Path or Channel), CWE-409 (Improper Handling of Highly Compressed Data (Data Amplification)).

How many critical apollographql apollo-router vulnerabilities are there?

apollographql apollo-router has 1 critical and 11 high-severity CVEs.

What is the average severity of apollographql apollo-router CVEs?

The average CVSS base score across apollographql apollo-router's scored CVEs is 7.8.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

apollographql

12 CVEs

cargo

apollographql apollo-router Vulnerabilities

Name: apollographql apollo-router vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for apollo-router by apollographql.

12

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

0

Public exploits

PoC or exploit code

7.8

Avg CVSS

2023–2025

Last updated November 7, 2025

Overview

apollographql apollo-router has 12 published CVE records since 2023, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 0 have a known public exploit. The average CVSS base score across scored CVEs is 7.8.

This page aggregates every publicly disclosed vulnerability (CVE) affecting apollographql apollo-router, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of apollographql apollo-router's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical1

High11

Medium0

Low0

In CISA’s Known Exploited Vulnerabilities catalog

0

None of apollographql apollo-router's CVEs are currently listed in CISA's KEV catalog.

Public exploits

0

No apollographql apollo-router CVEs currently have a tracked public exploit.

Affected versions and CVEs

Browse every apollographql apollo-router version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

< 1.61.24 CVEs
2.0.0-alpha.0 <= v < 2.1.14 CVEs
< 1.61.122 CVEs
2.0.0-alpha.0 <= v < 2.8.12 CVEs
< 1.52.11 CVE
0.9.5 <= v < 1.40.21 CVE
1.28.0 <= v < 1.29.11 CVE
1.31.0 <= v < 1.33.01 CVE
1.44.0 <= v < 1.45.11 CVE
1.7.0 <= v < 1.52.11 CVE

Fixed in

1.61.24 CVEs
2.1.14 CVEs
1.52.12 CVEs
1.61.122 CVEs
2.8.12 CVEs
1.29.11 CVE
1.33.01 CVE
1.40.21 CVE
1.45.11 CVE

Find a version

12 CVEs

Sort

Apollo Router Improperly Enforces Renamed Access Control Directives
CVE-2025-64347
Patch
CWE-284
High · CVSS 7.5
EPSS 0.3% (22th pct)2025-11-07
Apollo Router Core: Access Control Bypass on Polymorphic Types
CVE-2025-64173
Patch
CWE-288
High · CVSS 7.5
EPSS 0.3% (23th pct)2025-11-06
Apollo Router Query Validation Vulnerable to Excessive Resource Consumption via Named Fragment Processing
CVE-2025-32380
Patch
CWE-770
High · CVSS 7.5
EPSS 0.5% (42th pct)2025-04-09
Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion
CVE-2025-32034
Patch
CWE-770
High · CVSS 7.5
EPSS 0.5% (41th pct)2025-04-07
Apollo Router Operation Limits Vulnerable to Bypass via Integer Overflow
CVE-2025-32033
Patch
CWE-119
High · CVSS 7.5
EPSS 0.6% (43th pct)2025-04-07
Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass
CVE-2025-32032
Patch
CWE-770
High · CVSS 7.5
EPSS 0.6% (43th pct)2025-04-07
High vulnerability · 2024-08-27
CVE-2024-43414
Patch
CWE-674
High · CVSS 8.7
EPSS 1.0% (59th pct)2024-08-27
High vulnerability · 2024-08-27
CVE-2024-43783
Patch
CWE-770
High · CVSS 8.7
EPSS 0.9% (55th pct)2024-08-27
Critical vulnerability · 2024-05-02
CVE-2024-32971
Patch
CWE-670
Critical · CVSS 9.1
EPSS 0.7% (50th pct)2024-05-02
Apollo Router's Compressed Payloads do not respect HTTP Payload Limits
CVE-2024-28101
Patch
CWE-409
High · CVSS 7.5
EPSS 0.8% (52th pct)2024-03-06
Improper Check or Handling of Exceptional Conditions in apollo-router
CVE-2023-45812
Patch
CWE-754
High · CVSS 7.5
EPSS 0.7% (50th pct)2023-10-18
High vulnerability · 2023-09-05
CVE-2023-41317
Patch
CWE-755
High · CVSS 7.5
EPSS 0.7% (48th pct)2023-09-05

Common weakness types

The CWE weakness categories most often found in apollographql apollo-router CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many apollographql apollo-router CVEs were published each year.

2023

2

2024

4

2025

6

Other apollographql products

Browse vulnerabilities for other products by apollographql.

router12 CVEs apollo router6 CVEs federation5 CVEs apollo gateway3 CVEs apollo helms-charts router3 CVEs apollo client1 CVEs apollo-client1 CVEs apollo-client-integrations1 CVEs

All apollographql vulnerabilities

Frequently asked questions

Common questions about apollographql apollo-router vulnerabilities.

How many CVEs does apollographql apollo-router have?: apollographql apollo-router has 12 published CVE records since 2023.
How many apollographql apollo-router CVEs are in CISA KEV?: None of apollographql apollo-router's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for apollographql apollo-router vulnerabilities?: No apollographql apollo-router CVEs currently have a tracked public exploit in this dataset.
Which versions of apollographql apollo-router are affected?: 19 distinct apollographql apollo-router versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in apollographql apollo-router CVEs?: apollographql apollo-router's CVEs most often map to these CWE weakness types: CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-284 (Improper Access Control), CWE-288 (Authentication Bypass Using an Alternate Path or Channel), CWE-409 (Improper Handling of Highly Compressed Data (Data Amplification)).
How many critical apollographql apollo-router vulnerabilities are there?: apollographql apollo-router has 1 critical and 11 high-severity CVEs.
What is the average severity of apollographql apollo-router CVEs?: The average CVSS base score across apollographql apollo-router's scored CVEs is 7.8.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track apollographql apollo-router vulnerabilities

Monitor new apollographql apollo-router vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing