{"action":"Upgrade apollo-router to 1.40.2 or later.","affected":[{"fixed":"1.40.2","introduced":"0.9.5"}],"component":"apollo-router","cve_ids":["CVE-2024-28101"],"ecosystem":"crates.io","epss":0.0077,"exploited":false,"fixed_versions":["1.40.2"],"ghsa_id":"GHSA-cgqf-3cq5-wvcj","id":"tcs_01M5KEWX59X729CD553JS077CV","modified_at":"2026-02-17T20:10:48.127757Z","published_at":"2024-03-06T18:24:17Z","references":["https://osv.dev/vulnerability/GHSA-cgqf-3cq5-wvcj","https://github.com/apollographql/router/security/advisories/GHSA-cgqf-3cq5-wvcj","https://github.com/apollographql/router/commit/9e9527c73c8f34fc8438b09066163cd42520f413","https://github.com/apollographql/router"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-cgqf-3cq5-wvcj","url":"https://osv.dev/vulnerability/GHSA-cgqf-3cq5-wvcj"}],"summary":"Apollo Router's Compressed Payloads do not respect HTTP Payload Limits"}