CVE-2026-75005
Received Received - Intake

Inefficient Algorithmic Complexity in Apache APISIX

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: Apache Software Foundation

Description
Inefficient Algorithmic Complexity vulnerability in Apache APISIX. A single small request can pin a gateway worker at 100% CPU for an extended period in graphql-limit-count routes. This issue affects Apache APISIX: 3.17.0. Users are recommended to upgrade to version 3.18.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-75005
EUVD
EUVD-2026-66957

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apache apisix to 3.18.0 (exc)
apache apisix 3.18.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an inefficient algorithmic complexity issue in Apache APISIX versions up to 3.17.0. A single small request can cause a gateway worker to use 100% CPU for a long time in graphql-limit-count routes.

Detection Guidance

Detecting this vulnerability requires monitoring CPU usage spikes in Apache APISIX workers, particularly when handling GraphQL requests with rate limiting. Check for sustained 100% CPU usage on APISIX processes during GraphQL operations. Use system monitoring tools like top, htop, or ps to observe CPU consumption. Additionally, inspect logs for GraphQL-limit-count routes to identify unusually long processing times.

Impact Analysis

It can lead to denial of service by consuming excessive CPU resources, degrading performance, and potentially crashing the gateway for other users.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA. It is an algorithmic complexity issue causing high CPU usage, which may indirectly impact system availability and performance but does not inherently violate these standards.

Mitigation Strategies

Upgrade Apache APISIX to version 3.18.0 or later immediately. This version contains the fix for the inefficient algorithmic complexity issue. If upgrading is not immediately possible, consider temporarily disabling GraphQL-limit-count routes or applying strict rate limiting to reduce exposure until the upgrade is completed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75005. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart