Description
Inefficient Algorithmic Complexity vulnerability in Apache APISIX.

A single small request can pin a gateway worker at 100% CPU for an extended period in graphql-limit-count routes.




This issue affects Apache APISIX: 3.17.0.



Users are recommended to upgrade to version 3.18.0, which fixes the issue.
Published: 2026-08-27
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Apache APISIX suffers from an inefficient algorithmic complexity flaw that allows a single small request to lock a gateway worker at 100 percent CPU usage for an extended period. Because the worker remains busy, normal traffic cannot be processed, effectively shutting down the service. The flaw is classified as CWE-407 and results in a denial of service with no direct impact on confidentiality or integrity.

Affected Systems

The affected product is Apache Software Foundation’s Apache APISIX, specifically version 3.17.0. Users are advised to upgrade to version 3.18.0, which contains the fix.

Risk and Exploitability

The CVSS score of 8.7 indicates a high severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote; an adversary can send a crafted request to the gateway to trigger the compute‑heavy loop and exhaust CPU resources. Given the severity and lack of mitigation controls, the risk of exploitation is significant for exposed instances.

Generated by OpenCVE AI on August 27, 2026 at 10:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Apache APISIX to version 3.18.0 as soon as possible.
  • If an immediate upgrade is not feasible, restrict access to graphql‑limit‑count routes to authenticated users or apply network‑level rate limiting to prevent overload.
  • Continuously monitor gateway CPU utilization and apply temporary traffic shaping or circuit‑breaker policies to mitigate denial of service if the vulnerable endpoint remains exposed.

Generated by OpenCVE AI on August 27, 2026 at 10:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 27 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 27 Aug 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache apisix
Vendors & Products Apache
Apache apisix

Thu, 27 Aug 2026 09:30:00 +0000

Type Values Removed Values Added
Description Inefficient Algorithmic Complexity vulnerability in Apache APISIX. A single small request can pin a gateway worker at 100% CPU for an extended period in graphql-limit-count routes. This issue affects Apache APISIX: 3.17.0. Users are recommended to upgrade to version 3.18.0, which fixes the issue.
Title Apache APISIX: Unauthenticated CPU-exhaustion DoS
Weaknesses CWE-407
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Apache Apisix
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-08-27T12:06:27.060Z

Reserved: 2026-08-17T12:56:01.921Z

Link: CVE-2026-75005

cve-icon Vulnrichment

Updated: 2026-08-27T10:22:02.818Z

cve-icon NVD

Status : Received

Published: 2026-08-27T10:16:36.493

Modified: 2026-08-27T13:18:37.117

Link: CVE-2026-75005

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-27T10:30:06Z

Weaknesses
  • CWE-407

    Inefficient Algorithmic Complexity