GHSA-9Q47-3CM2-2RP8 pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header

Summary pyLoad determines the "client IP" used for its rate-limiting decorator and for its security/audit logging by reading the client-supplied X-Forwarded-For XFF HTTP header and taking the leftmost value. No trusted-proxy configuration exists the Cheroot WSGI server faces clients directly, and...

pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header

Summary pyLoad determines the "client IP" used for its rate-limiting decorator and for its security/audit logging by reading the client-supplied X-Forwarded-For XFF HTTP header and taking the leftmost value. No trusted-proxy configuration exists the Cheroot WSGI server faces clients directly, and...