EUVD-2026-66957
GHSA-7p87-32cx-94g2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify APISIX gateway with graphql-limit-count route
-
DeliverySend single crafted small HTTP request
-
ExploitTrigger worst-case algorithmic processing in plugin
-
ExecutionPin gateway worker at 100% CPU
-
ImpactDeny service to legitimate API traffic
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Algorithmic complexity limits
|
| Exploitation Conditions | Exploitation requires the graphql-limit-count plugin to be enabled and applied to at least one route on the Apache APISIX 3.17.0 instance - instances not using this plugin on any route are not exposed regardless of network accessibility. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms that no authentication, no special attack preconditions, and no user interaction are required once a vulnerable route is reachable. The impact is strictly limited to availability: worker CPU exhaustion only, with no code execution, no data access, and no integrity violation implied by the description or CVSS metrics. The 'Information Disclosure' tag in the source data is inconsistent with these metrics and should not expand the assumed impact scope. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) is internally consistent with the described vulnerability: network-reachable, unauthenticated, zero-complexity exploitation yielding high availability impact with no confidentiality or integrity consequence and no downstream system impact. The 8.7 score is justified for environments actively using the graphql-limit-count plugin. However, deployments not using this plugin on any route are entirely unaffected, which significantly narrows the real-world exposed population. The 'Information Disclosure' tag present in the source intelligence data directly conflicts with the CWE-407 classification and the CVSS impact metrics (VC:N/VI:N); this appears to be a tagging error and should not be treated as a confirmed secondary impact. No EPSS score was provided, no CISA KEV listing exists, and no public POC has been identified - real-world exploitation is unconfirmed. Despite the high CVSS score, this is a high-priority patch for graphql-limit-count users but low exposure for everyone else. |
| Exploit ScenarioDerived | An unauthenticated attacker probes an Apache APISIX 3.17.0 deployment and identifies a route with the graphql-limit-count plugin enabled. The attacker submits a single small, specially structured HTTP request to that route, triggering worst-case algorithmic processing in the plugin and pinning the target worker process at 100% CPU for an extended period. By repeating this at low frequency across multiple requests or connections, the attacker can sustain denial of service against the gateway with negligible bandwidth, effectively blocking legitimate API traffic. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 27, 2026
CPU exhaustion via algorithmic complexity in Apache APISIX 3.17.0 allows unauthenticated remote attackers to pin a gateway worker process at 100% CPU using a single small HTTP request targeting routes protected by the graphql-limit-count plugin. The CVSS 4.0 score of 8.7 reflects the high availability impact and trivial exploitation requirements - no authentication, no complexity, no user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the minimal attack payload described makes this class of vulnerability straightforward to weaponize once the affected plugin is known to be in use.
Earlier versions of this analysis (1)
CPU-exhaustion denial of service in Apache APISIX 3.17.0 allows any network-reachable, unauthenticated attacker to pin a gateway worker process at 100% CPU by sending a single small, crafted request against routes configured with the graphql-limit-count plugin. The inefficient algorithmic complexity means the amplification is asymmetric - trivial attacker effort yields sustained worker starvation, effectively blocking all traffic handled by that worker. No public exploit code or CISA KEV listing has been identified at time of analysis, though full vulnerability details are publicly available via the oss-security mailing list disclosure.
RemediationAI
Upgrade Apache APISIX to version 3.18.0, which is confirmed by the vendor to resolve this issue; the fix is documented in the Apache OSS Security advisory at https://seclists.org/oss-sec/2026/q3/591 and the Apache APISIX project site at https://apisix.apache.org. For deployments that cannot upgrade immediately, disabling or removing the graphql-limit-count plugin from all route configurations eliminates the attack surface entirely, at the cost of losing GraphQL rate-limiting enforcement on those routes - which may need to be compensated by upstream controls. Placing an upstream rate limiter at the load balancer or CDN layer to cap per-source request rates reaching APISIX workers can reduce the practical DoS impact, but does not address the root cause and may not prevent a determined attacker from exhausting workers via distributed sources. No additional workarounds are documented in the available advisory data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache APISIX is a cloud-native, high-performance API gateway commonly used to manage, route, and protect API traffic. CWE-407 (Inefficient Algorithmic Complexity) describes a root cause where the algorithm's execution time grows superlinearly relative to input characteristics, allowing an attacker to craft minimal input that drives worst-case processing. In this instance, the graphql-limit-count plugin - responsible for applying rate limiting to GraphQL API routes - contains logic whose complexity can be fully triggered by a single small request, monopolizing an event-loop or process worker thread. This pattern is analogous to ReDoS (regular expression denial of service) but applies to graph traversal, counting, or parsing logic rather than regex backtracking. Affected version is explicitly 3.17.0 per the vendor advisory; no CPE string was supplied in the source data.
Know when Apisix gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network-reachable unauthenticated DoS with no confidentiality or integrity impact; single request triggers worst-case CPU exhaustion confined to the vulnerable worker process.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
2Description PRE-NVD
Articles & Coverage 2
Executive ViewAI
Apache APISIX 3.17.0 contains a critical availability vulnerability in the graphql-limit-count plugin that allows unauthenticated attackers to exhaust CPU resources on gateway worker processes with a single malformed HTTP request. Organizations running this version risk immediate denial of service to API gateway infrastructure without authentication barriers. This directly impacts API platform availability and all downstream services dependent on this infrastructure.
Until vendor patch is released: (1) Disable graphql-limit-count plugin if not critical to business operations; (2) Implement network-level rate limiting on routes protected by this plugin; (3) Deploy WAF rules to filter anomalous GraphQL requests targeting limit-count operations; (4) Add CPU utilization monitoring and automated alerts on APISIX worker processes; (5) Restrict network access to affected API routes to known internal clients where feasible; (6) Configure APISIX to restart crashed workers automatically to minimize service disruption.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Rated medium sev
The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification. Rated high severity (CVSS 7.
In Apache APISIX before 2.13.0, when decoding JSON with duplicate keys, lua-cjson will choose the last occurred value as
Incorrect Permission Assignment for Critical Resource vulnerability in Apache APISIX(java-plugin-runner). Local listeni
Plaintext credential exposure in Apache APISIX before 3.14 affects deployments using the basic-auth plugin with INFO or
In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the er
LDAP injection in Apache APISIX's ldap-auth plugin allows a caller holding valid credentials for any LDAP directory entr
Response poisoning in Apache APISIX 2.12.0 through 3.17.0 enables remote attackers to manipulate the gateway's serverles
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Apache APISIX when using `forwa
Authorization bypass and privilege escalation in Apache APISIX 3.11.0-3.17.0 stem from the `attach-consumer-label` plugi
CVE-2025-46647 is a security vulnerability (CVSS 5.3). Remediation should follow standard vulnerability management proce
Exploit-DB