Vulnerability DatabaseCVE-2026-75005
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2026-75005
Published:August 27, 2026
Updated:September 24, 2026
Inefficient Algorithmic Complexity vulnerability in Apache APISIX. A single small request can pin a gateway worker at 100% CPU for an extended period in graphql-limit-count routes. This issue affects Apache APISIX: 3.17.0. Users are recommended to upgrade to version 3.18.0, which fixes the issue.
Affected Packages
https://github.com/apache/apisix.git (GITHUB):
Affected version(s) =3.17.0 <3.18.0
Fix Suggestion:
Update to version 3.18.0
Related Resources (7)
https://www.openwall.com/lists/oss-security/2026/08/26/13
https://github.com/apache/apisix/commit/03922900726e086fa1002ecf76cc4edfd0ee2e7e
https://www.cve.org/CVERecord?id=CVE-2026-75005
https://lists.apache.org/thread/wfs7c9l8sokrh9hzv84lno12nx2zxpjk
http://www.openwall.com/lists/oss-security/2026/08/26/13
https://nvd.nist.gov/vuln/detail/CVE-2026-75005
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75005.json
Do you need more information?
Contact Us
CVSS v4
Base Score:
8.7
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
NONE
Vulnerable System Integrity
NONE
Vulnerable System Availability
HIGH
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Weakness Type (CWE)
Inefficient Algorithmic Complexity
CWE-407
EPSS
Base Score:
0.80