CVE-2026-75005 is an inefficient algorithmic complexity flaw (CWE-407) in Apache APISIX. One small request can pin a gateway worker at full CPU for a long time on graphql-limit-count routes. The record rates it High at 7.5. Apache says upgrade to version 3.18.0.
What's affected
Apache says the issue affects APISIX 3.17.0, and recommends upgrading to 3.18.0. This is narrower than the other APISIX advisories from the same day, which cover ranges starting at 2.11.0 and 2.12.0. The record matches Apache here.
The affected feature is the graphql-limit-count plugin, which limits requests by GraphQL query cost. Only routes that use it are in the path. The record scores it 7.5 (High): network access, no privileges, no user interaction, and high impact on availability only. Apache's announcement calls it an unauthenticated CPU exhaustion denial of service.
How to check if you're exposed
Find the version of APISIX on each gateway.
apisix version
For containers, check the image tag. Then review your routes with the plugin named in this CVE, since only routes that use it are in the path. You can list routes through the Admin API or in your configuration files.
What to do now
- Upgrade Apache APISIX 3.17.0 to 3.18.0.
- Identify routes that use graphql-limit-count and treat them as the priority.
- Set worker and request timeouts so that a stuck worker is recycled.
- Alert on gateway worker CPU saturation, not only on average CPU.
- Test GraphQL routes with unusual but valid queries in staging.
Why it matters
The weakness is inefficient algorithmic complexity, CWE-407. Some code paths take far longer for certain inputs than for typical ones, and the amount of work grows faster than the size of the input. A gateway worker is single threaded for the work it does, so a request that makes it spin starves everyone behind it.
The reason this matters on a gateway is amplification: one small unauthenticated request ties up a worker, and a handful of them can take the service down. Rate limiting does not help when the limiter itself is the code that spins. Timeouts and per request CPU budgets are the generic mitigations, and the upgrade is the specific one. KEV status is false.
Quick check
Is my gateway affected if I never use GraphQL?
The advisory ties the issue to graphql-limit-count routes. Without that plugin in use, the exposure is much smaller.
Which versions are affected?
Apache lists 3.17.0 only.
Sources
Last reviewed: 18 October 2026.
