EUVD-2025-32539

Litestar X-Forwarded-For Header Spoofing Vulnerability Enables Rate Limit Evasion...

GHSA-HM36-FFRH-C77C Litestar X-Forwarded-For Header Spoofing Vulnerability Enables Rate Limit Evasion

While testing Litestar's RateLimitMiddleware, I discovered that rate limits can be completely bypassed by manipulating the X-Forwarded-For header. This renders IP-based rate limiting ineffective against determined attackers. The Problem Litestar's RateLimitMiddleware uses cachekeyfromrequest to...

Litestar X-Forwarded-For Header Spoofing Vulnerability Enables Rate Limit Evasion

While testing Litestar's RateLimitMiddleware, I discovered that rate limits can be completely bypassed by manipulating the X-Forwarded-For header. This renders IP-based rate limiting ineffective against determined attackers. The Problem Litestar's RateLimitMiddleware uses cachekeyfromrequest to...

CVE-2025-59152

Litestar is an Asynchronous Server Gateway Interface ASGI framework. In version 2.17.0, rate limits can be completely bypassed by manipulating the X-Forwarded-For header. This renders IP-based rate limiting ineffective against determined attackers. Litestar's RateLimitMiddleware uses...

UBUNTU-CVE-2025-59152

Litestar is an Asynchronous Server Gateway Interface ASGI framework. In version 2.17.0, rate limits can be completely bypassed by manipulating the X-Forwarded-For header. This renders IP-based rate limiting ineffective against determined attackers. Litestar's RateLimitMiddleware uses...

Reliance on Untrusted Inputs in a Security Decision

Overview litestar is a Litestar - A production-ready, highly performant, extensible ASGI API Framework Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision due to the use of X-Forwarded-For header in the cachekeyfromrequest function. An attacker...

CVE-2025-59152 X-Forwarded-For Header Spoofing Bypasses Litestar Rate Limiting

Litestar is an Asynchronous Server Gateway Interface ASGI framework. In version 2.17.0, rate limits can be completely bypassed by manipulating the X-Forwarded-For header. This renders IP-based rate limiting ineffective against determined attackers. Litestar's RateLimitMiddleware uses...

CVE-2025-59152 X-Forwarded-For Header Spoofing Bypasses Litestar Rate Limiting

Litestar is an Asynchronous Server Gateway Interface ASGI framework. In version 2.17.0, rate limits can be completely bypassed by manipulating the X-Forwarded-For header. This renders IP-based rate limiting ineffective against determined attackers. Litestar's RateLimitMiddleware uses...

CVE-2025-59152 X-Forwarded-For Header Spoofing Bypasses Litestar Rate Limiting

Litestar is an Asynchronous Server Gateway Interface ASGI framework. In version 2.17.0, rate limits can be completely bypassed by manipulating the X-Forwarded-For header. This renders IP-based rate limiting ineffective against determined attackers. Litestar's RateLimitMiddleware uses...

CVE-2025-59152

Litestar vulnerability in RateLimitMiddleware: when X-Forwarded-For is present, cache_key_from_request() trusts it unconditionally, enabling per-header-bucket rate-limiting and bypass of IP-based quotas. Affected: Litestar 2.17.0 with default RateLimitMiddleware configuration. Mitigation: upgrade...

Litestar 安全漏洞

Litestar is a powerful, flexible but stubborn ASGI framework open-sourced by Litestar. A security vulnerability exists in Litestar version 2.17.0 that stems from unconditional trust in the X-Forwarded-For header, which could lead to bypassing rate limiting...

PT-2025-40902

Name of the Vulnerable Software and Affected Versions Litestar versions prior to 2.18.0 Description Litestar is an Asynchronous Server Gateway Interface ASGI framework. In version 2.17.0, rate limits can be bypassed by manipulating the X-Forwarded-For header. The RateLimitMiddleware uses cache ke...

EUVD-2024-0214

Malicious code in bioql PyPI...

EUVD-2024-2492

Malicious code in bioql PyPI...

EUVD-2025-29452

Malicious code in bioql PyPI...

Improper Output Neutralization for Logs

Overview litestar is a Litestar - A production-ready, highly performant, extensible ASGI API Framework Affected versions of this package are vulnerable to Improper Output Neutralization for Logs via the exception logging process. An attacker can manipulate log files and forge log entries by...

Litestar has potential log injection in exception logging

Summary Litestar does not escape url paths when logging exceptions. This makes logger vulnerable to CRLF injection if logging level is configured to debug or logexceptions is set to "always", which allows attackers to inject newlines and forge log entries. Details Litestar directly formats unquot...

CVE-2024-52581

Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 2.13.0, the multipart form parser shipped with litestar expects the entire request body as a single byte string and there is no default limit for the total size of the request body. This allows an attacker to...

CVE-2024-32982

Litestar and Starlite is an Asynchronous Server Gateway Interface ASGI framework. Prior to 2.8.3, 2.7.2, and 2.6.4, a Local File Inclusion LFI vulnerability has been discovered in the static file serving component of LiteStar. This vulnerability allows attackers to exploit path traversal flaws,...

CVE-2024-42370

Litestar is an Asynchronous Server Gateway Interface ASGI framework. In versions 2.10.0 and prior, Litestar's docs-preview.yml workflow is vulnerable to Environment Variable injection which may lead to secret exfiltration and repository manipulation. This issue grants a malicious actor the...