EUVD-2020-1513

Malware in sbrugna...

PT-2025-41013

Name of the Vulnerable Software and Affected Versions Rack versions prior to 2.2.19 Rack versions prior to 3.1.17 Rack versions prior to 3.2.2 Description Rack is a modular Ruby web server interface. The Rack::Multipart::Parser component stores non-file form fields in memory as Ruby String object...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-405385)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-405385 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix a potential buffer overflow in 'dpdscclockenread' Tell snprintf to store at...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-986564)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986564 advisory. In the Linux kernel, the following vulnerability has been resolved: IB/core: Implement a limit on UMAD receive List The existing behavior of ibumad, which maintains...

Unity Linux 20.1070e Security Update: golang (UTSA-2025-986181)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986181 advisory. Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-408084)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-408084 advisory. In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: limit printed string from FW file There's no guarantee here that the file is alway...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987354)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987354 advisory. In the Linux kernel, the following vulnerability has been resolved: netsched: fix NULL deref in fifosetlimit syzbot reported another NULL deref in fifosetlimit 1 I...

PT-2025-41132

Name of the Vulnerable Software and Affected Versions Rack versions prior to 2.2.19 Rack versions prior to 3.1.17 Rack versions prior to 3.2.2 Description Rack is a modular Ruby web server interface. The Rack::Multipart::Parser component can accumulate unbounded data when processing multipart...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-414591)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-414591 advisory. The iouring subsystem in the Linux kernel allowed the MAXRWCOUNT limit to be bypassed in the PROVIDEBUFFERS operation, which led to negative values being usedin memr...

PT-2025-41012

Name of the Vulnerable Software and Affected Versions Rack versions prior to 2.2.19 Rack versions prior to 3.1.17 Rack versions prior to 3.2.2 Description Rack is a modular Ruby web server interface. The Rack::Multipart::Parser component does not limit the size of the multipart preamble,...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987271)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987271 advisory. In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: oss: Limit the period size to 16MB Set the practical limit to the period size the...

Unity Linux 20.1070e Security Update: golang (UTSA-2025-986183)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986183 advisory. Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory,...

Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion)

Summary Rack::Multipart::Parser buffers the entire multipart preamble bytes before the first boundary in memory without any size limit. A client can send a large preamble followed by a valid boundary, causing significant memory use and potential process termination due to out-of-memory OOM...

GHSA-HM36-FFRH-C77C Litestar X-Forwarded-For Header Spoofing Vulnerability Enables Rate Limit Evasion

While testing Litestar's RateLimitMiddleware, I discovered that rate limits can be completely bypassed by manipulating the X-Forwarded-For header. This renders IP-based rate limiting ineffective against determined attackers. The Problem Litestar's RateLimitMiddleware uses cachekeyfromrequest to...

EUVD-2025-32539

Litestar X-Forwarded-For Header Spoofing Vulnerability Enables Rate Limit Evasion...

Litestar X-Forwarded-For Header Spoofing Vulnerability Enables Rate Limit Evasion

While testing Litestar's RateLimitMiddleware, I discovered that rate limits can be completely bypassed by manipulating the X-Forwarded-For header. This renders IP-based rate limiting ineffective against determined attackers. The Problem Litestar's RateLimitMiddleware uses cachekeyfromrequest to...

CVE-2025-59152

Litestar is an Asynchronous Server Gateway Interface ASGI framework. In version 2.17.0, rate limits can be completely bypassed by manipulating the X-Forwarded-For header. This renders IP-based rate limiting ineffective against determined attackers. Litestar's RateLimitMiddleware uses...

UBUNTU-CVE-2025-59152

Litestar is an Asynchronous Server Gateway Interface ASGI framework. In version 2.17.0, rate limits can be completely bypassed by manipulating the X-Forwarded-For header. This renders IP-based rate limiting ineffective against determined attackers. Litestar's RateLimitMiddleware uses...

CVE-2025-59152 X-Forwarded-For Header Spoofing Bypasses Litestar Rate Limiting

Litestar is an Asynchronous Server Gateway Interface ASGI framework. In version 2.17.0, rate limits can be completely bypassed by manipulating the X-Forwarded-For header. This renders IP-based rate limiting ineffective against determined attackers. Litestar's RateLimitMiddleware uses...

CVE-2025-59152

Litestar vulnerability in RateLimitMiddleware: when X-Forwarded-For is present, cache_key_from_request() trusts it unconditionally, enabling per-header-bucket rate-limiting and bypass of IP-based quotas. Affected: Litestar 2.17.0 with default RateLimitMiddleware configuration. Mitigation: upgrade...