1398 matches found
EUVD-2025-32539
Litestar X-Forwarded-For Header Spoofing Vulnerability Enables Rate Limit Evasion...
GHSA-HM36-FFRH-C77C Litestar X-Forwarded-For Header Spoofing Vulnerability Enables Rate Limit Evasion
While testing Litestar's RateLimitMiddleware, I discovered that rate limits can be completely bypassed by manipulating the X-Forwarded-For header. This renders IP-based rate limiting ineffective against determined attackers. The Problem Litestar's RateLimitMiddleware uses cachekeyfromrequest to...
Reliance on Untrusted Inputs in a Security Decision
Overview litestar is a Litestar - A production-ready, highly performant, extensible ASGI API Framework Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision due to the use of X-Forwarded-For header in the cachekeyfromrequest function. An attacker...
CVE-2025-59152 X-Forwarded-For Header Spoofing Bypasses Litestar Rate Limiting
Litestar is an Asynchronous Server Gateway Interface ASGI framework. In version 2.17.0, rate limits can be completely bypassed by manipulating the X-Forwarded-For header. This renders IP-based rate limiting ineffective against determined attackers. Litestar's RateLimitMiddleware uses...
CVE-2025-59152
Litestar vulnerability in RateLimitMiddleware: when X-Forwarded-For is present, cache_key_from_request() trusts it unconditionally, enabling per-header-bucket rate-limiting and bypass of IP-based quotas. Affected: Litestar 2.17.0 with default RateLimitMiddleware configuration. Mitigation: upgrade...
CVE-2025-59152 X-Forwarded-For Header Spoofing Bypasses Litestar Rate Limiting
Litestar is an Asynchronous Server Gateway Interface ASGI framework. In version 2.17.0, rate limits can be completely bypassed by manipulating the X-Forwarded-For header. This renders IP-based rate limiting ineffective against determined attackers. Litestar's RateLimitMiddleware uses...
Litestar 安全漏洞
Litestar is a powerful, flexible but stubborn ASGI framework open-sourced by Litestar. A security vulnerability exists in Litestar version 2.17.0 that stems from unconditional trust in the X-Forwarded-For header, which could lead to bypassing rate limiting...
EUVD-2023-57860
Malicious code in bioql PyPI...
EUVD-2022-51885
Malicious code in bioql PyPI...
EUVD-2024-2505
Malicious code in bioql PyPI...
EUVD-2022-51871
Malicious code in bioql PyPI...
EUVD-2022-51470
Malicious code in bioql PyPI...
EUVD-2022-29473
Malicious code in bioql PyPI...
EUVD-2022-51874
Malicious code in bioql PyPI...
EUVD-2022-53387
Malicious code in bioql PyPI...
EUVD-2022-51864
Malicious code in bioql PyPI...
EUVD-2023-0887
Malicious code in bioql PyPI...
EUVD-2022-1953
Malicious code in bioql PyPI...