GHSA-fmj9-77q8-g6c4 Apollo Query Planner and Apollo Gateway may infinitely loop on sufficiently complex queries

• crates.io apollo-router: < 1.52.1 → fixed in 1.52.1 • npm @apollo/query-planner: >= 2.0.0, < 2.8.5 → fixed in 2.8.5 • npm @apollo/gateway: >= 2.0.0, < 2.8.5 → fixed in 2.8.5

Impact Instances of @apollo/query-planner >=2.0.0 and =2.0.0 and `Number.MAX_VALUE`: ```graphql query { field_1: field field_2: field # ... field_1023: field field_1024: field } ``` However, in a graph that provided 5 options to solve a given field, the bug could be encountered in a query that aliased the field approximately 440 times. Patches @apollo/query-planner 2.8.5 @apollo/gateway 2.8.5 Apollo Router 1.52.1 Workarounds This issue can be avoided by ensuring there are no fields resolvable from multiple subgraphs. If all subgraphs are using Federation 2, you can confirm that you are not impacted by ensuring that none of your subgraph schemas use the `@shareable` directive. If you are using Federation 1 subgraphs, you will need to validate that there are no fields resolvable by multiple subgraphs. Note that a supergraph can contain a mix of Federation 1 and Federation 2 subgraphs. If you do have fields resolvable by multiple subgraphs, changing this behavior in response to this issue may be risky to the operation of your supergraph. We recommend that you update to a patched version of either Apollo Router or Apollo Gateway. Apollo customers with an enterprise entitlement using the Apollo Router can also mitigate much of the risk from this issue by implementing Apollo’s Persisted Queries (PQ) feature. With PQ enabled, the Apollo Router will only execute safelisted queries. While customers would need to ensure that queries that induce this issue are not added to the safelist, PQs would mitigate the risk of clients submitting ad hoc queries that exploit this issue. References Additional information on Query Plans