CVE-2026-75005

Inefficient Algorithmic Complexity vulnerability in Apache APISIX. A single small request can pin a gateway worker at 100% CPU for an extended period in graphql-limit-count routes. This issue affects Apache APISIX: 3.17.0. Users are recommended to upgrade to version 3.18.0, which fixes the issue.

View graph Watch Export

CVSS v3.1

7.5 HIGH

EPSS

0.80%

probability of exploitation in 30 days

CISA KEV

Not listed

no confirmed exploitation reported

News coverage

sources referencing this CVE

EPSS Trend

Aug 28, 2026 → Aug 30, 2026

▲ 0.35pp

0.45% → 0.80% over 3 tracked changes

CVSS v3.1 Detail

Attack VectorNETWORK

Attack ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

ScopeUNCHANGED

ConfidentialityNONE

IntegrityNONE

AvailabilityHIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Connections

2 relationships

CWE-407

source

Timeline

disclosure → media coverage

Aug 27, 2026

Disclosure — published as a CVE record.