CVE-2026-75005: 
Apache APISIX vulnerability analysis and mitigation

CVE-2026-75005 is an Inefficient Algorithmic Complexity (CWE-407) vulnerability in Apache APISIX that allows an unauthenticated remote attacker to cause a Denial of Service by sending a single small request to a graphql-limit-count route, pinning a gateway worker at 100% CPU for an extended period. Only Apache APISIX version 3.17.0 is affected; all other versions are listed as unaffected by default. The vulnerability was disclosed on August 26, 2026, via the Apache security mailing list and the oss-security list, with a patch released in version 3.18.0. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (Apache Advisory, GitHub Advisory, oss-security).

The vulnerability is classified as CWE-407 (Inefficient Algorithmic Complexity), meaning the graphql-limit-count plugin in Apache APISIX 3.17.0 contains an algorithm whose worst-case computational complexity can be triggered by a specially crafted — but otherwise small — GraphQL request. When such a request is processed, the affected gateway worker enters a computationally expensive code path that consumes 100% CPU for an extended duration, effectively blocking that worker from handling any other traffic. No authentication, special privileges, or user interaction is required; the attack is fully network-accessible and automatable (Apache Advisory, oss-security, GitHub Advisory).

Successful exploitation results in a high-availability impact: one or more gateway worker processes are rendered unresponsive for an extended period, degrading or completely blocking API traffic routed through the affected APISIX instance. There is no confidentiality or integrity impact — the attack is purely a resource exhaustion Denial of Service. In deployments with limited worker concurrency, a small number of crafted requests could saturate all available workers, causing a full service outage for all upstream services behind the gateway (Apache Advisory, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.796% (54th percentile), indicating a relatively low but non-negligible probability of exploitation within 30 days. However, the attack is rated as automatable by NVD SSVC analysis, meaning it requires no complex setup and could be scripted trivially (GitHub Advisory, Apache Advisory).

1. Reconnaissance: Identify internet-facing Apache APISIX instances running version 3.17.0, using tools like Shodan or Censys, or by querying the APISIX Admin API for version information.
2. Identify target routes: Determine which routes on the target APISIX instance have the graphql-limit-count plugin enabled, either through API enumeration or by probing known GraphQL endpoints.
3. Craft malicious request: Construct a small but algorithmically expensive GraphQL request (e.g., a deeply nested or otherwise pathological query structure) designed to trigger the worst-case complexity path in the graphql-limit-count plugin.
4. Send request: Transmit the crafted HTTP request to the target graphql-limit-count route without any authentication headers.
5. Observe impact: The targeted gateway worker process consumes 100% CPU and becomes unresponsive; repeating the request against additional workers can exhaust all available worker capacity, causing a full service outage (oss-security, Apache Advisory).

• Network: Repeated or sustained HTTP/HTTPS requests to routes with the graphql-limit-count plugin enabled, particularly with unusual or deeply nested GraphQL query bodies; requests originating from a single or small set of source IPs.
• Process/System: APISIX worker processes (typically nginx workers) sustaining 100% CPU utilization for extended periods without a corresponding spike in legitimate traffic volume.
• Logs: APISIX access logs showing requests to GraphQL-enabled routes with small payload sizes but abnormally long processing times; error logs indicating worker timeouts or restarts.
• Metrics: Sudden drop in gateway throughput or increase in request latency/timeouts correlated with CPU saturation on the APISIX host (oss-security, Apache Advisory).

The primary remediation is to upgrade Apache APISIX from version 3.17.0 to version 3.18.0, which contains the fix for this vulnerability (Apache Advisory, oss-security). If immediate patching is not possible, administrators should restrict network access to routes using the graphql-limit-count plugin (e.g., via IP allowlisting or WAF rules) to reduce exposure. Additionally, monitoring gateway worker CPU usage for anomalous spikes can help detect exploitation attempts early.

The vulnerability was reported by security researcher Md. Amdadul Bari and disclosed by Abhishek Choudhary via the oss-security mailing list on August 26, 2026 (oss-security). Social media activity was observed on Bluesky shortly after disclosure, with infosec community accounts noting the advisory. Coverage was also picked up by vulnerability aggregators including VulDB, vulners.com, and CIRCL's vulnerability database. No major vendor statements beyond the Apache advisory or significant analyst commentary have been identified at this time.