CVE-2026-75005

HIGH 7.5CVE-2026-75005 · Published 27/08/2026 · updated 28/08/2026

In short

CVE-2026-75005 is a HIGH (CVSS 7.5) vulnerability affecting apisix (apache).
Chance of exploitation in the next 30 days (EPSS): 0.74%, higher than 54.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
apisix apache	`= 3.17.0`	No fix yet

Description

Inefficient Algorithmic Complexity vulnerability in Apache APISIX. A single small request can pin a gateway worker at 100% CPU for an extended period in graphql-limit-count routes. This issue affects Apache APISIX: 3.17.0. Users are recommended to upgrade to version 3.18.0, which fixes the issue.

References

lists.apache.org/thread/wfs7c9l8sokrh9hzv84lno12nx2zxpjk · Mailing List
openwall.com/lists/oss-security/2026/08/26/13 · Mailing List

More vulnerabilities in apisix

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

apisix

apache

= 3.17.0

No fix yet

Description

More vulnerabilities in apisix

See all →