An unauthenticated remote denial of service vulnerability in Apache APISIX version 3.17.0 allows attackers to exhaust system resources by inducing high CPU utilization.

This is an inefficient algorithmic complexity flaw (CWE-407) occurring within the graphql-limit-count routes. An unauthenticated attacker can trigger this condition by sending a specially crafted request, forcing the gateway worker to consume maximum CPU resources for an extended duration.

The exploitation of this vulnerability results in a denial of service for the affected gateway, which can lead to significant operational downtime and service unavailability. Given the CVSS score of 8.7, this is a high-severity issue that directly threatens the availability of critical API infrastructure. Organizations relying on APISIX for traffic management may face severe service degradation or total failure if this vulnerability is targeted.

Immediate Action: Upgrade to Apache APISIX version 3.18.0 or later to resolve the algorithmic inefficiency.

Proactive Monitoring: Monitor CPU usage metrics on all APISIX gateway nodes and review access logs for high volumes of traffic directed toward graphql-limit-count endpoints.

Compensating Controls: Implement rate limiting or request validation at the edge layer to restrict access to the vulnerable GraphQL routes until the patch can be deployed.

Public Exploit Available: No

The high CVSS score and the potential for total resource exhaustion necessitate immediate prioritization of this patch. Security teams should verify their current APISIX version deployment and schedule an update to version 3.18.0 as soon as possible to prevent potential service outages.