CVE-2026-94250
Deferred Deferred - Pending Action

Allocation of Resources Without Limits in Apache APISIX Batch-Requests Plugin

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: Apache Software Foundation

Description
Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX. An unauthenticated caller can drive a gateway worker into OOM via a route where the batch-requests plugin is used and the batch endpoint is publicly exposed. This issue affects Apache APISIX: from 1.3.0 through 3.18.0. Users are recommended to upgrade to version 3.19.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-94250
EUVD
EUVD-2026-90767

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apache apisix From 1.3.0 (inc) to 3.18.0 (inc)
apache apisix 3.19.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an allocation of resources without limits or throttling vulnerability in the batch-requests plugin of Apache APISIX. An unauthenticated attacker can cause a gateway worker to run out of memory by accessing a route where the batch-requests plugin is enabled and the batch endpoint is publicly exposed.

Detection Guidance

Check if Apache APISIX is running a vulnerable version (1.3.0 through 3.18.0) by inspecting the version in logs or configuration files. Verify if the batch-requests plugin is enabled and if the batch endpoint is publicly exposed.

Impact Analysis

This vulnerability can lead to denial of service by crashing the gateway worker due to excessive memory consumption. It may disrupt services relying on Apache APISIX for routing and request handling.

Compliance Impact

This vulnerability could potentially impact compliance with standards like GDPR and HIPAA by enabling denial-of-service conditions through resource exhaustion (OOM). Uncontrolled memory consumption may disrupt availability of systems processing sensitive data, which is a key requirement under both regulations.

Mitigation Strategies

Upgrade Apache APISIX to version 3.19.0 or later to address the vulnerability. If upgrading is not immediately possible, disable the batch-requests plugin or restrict access to the batch endpoint to prevent unauthenticated calls.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94250. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart