-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| apollo-router | rust | >= 0.9.5, < 1.40.2 | 1.40.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper handling of compressed payloads where decompression happened before size validation. The removed decompress_request_body function in utils.rs explicitly used blocking operations (hyper::body::to_bytes()) to read the entire compressed payload into memory before decompression. This violates the principle of applying payload size limits pre-decompression, as demonstrated by its replacement with streaming decompression middleware (RequestDecompressionLayer) in the patch. The function's removal in the security fix directly correlates with the described vulnerability pattern.