crates.io/apollo-router CVE-2024-28101: high 7.5, EPSS 0.77%

Apollo Router's Compressed Payloads do not respect HTTP Payload Limits

Action: Upgrade apollo-router to 1.40.2 or later.

cargo update -p apollo-router --precise 1.40.2

Affected

Fixed versions

Sources

• osv: GHSA-cgqf-3cq5-wvcj
• https://github.com/apollographql/router/security/advisories/GHSA-cgqf-3cq5-wvcj
• https://github.com/apollographql/router/commit/9e9527c73c8f34fc8438b09066163cd42520f413
• https://github.com/apollographql/router

CVE-2024-28101 · published 2024-03-06T18:24:17Z · modified 2026-02-17T20:10:48.127757Z · JSON