X-Forwarded-For Header Spoofing Bypasses Litestar Rate Limiting
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In version 2.17.0, rate limits can be completely bypassed by manipulating the X-Forwarded-For header. This renders IP-based rate limiting ineffective against determined attackers. Litestar's RateLimitMiddleware uses `cache_key_from_request()` to generate cache keys for rate limiting. When an X-Forwarded-For header is present, the middleware trusts it unconditionally and uses its value as part of the client identifier. Since clients can set arbitrary X-Forwarded-For values, each different spoofed IP creates a separate rate limit bucket. An attacker can rotate through different header values to avoid hitting any single bucket's limit. This affects any Litestar application using RateLimitMiddleware with default settings, which likely includes most applications that implement rate limiting. Version 2.18.0 contains a patch for the vulnerability.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| litestar-org | litestar | = 2.17.0 | — | No fix listed | CNA |
| — | litestar (PyPI) | 2.17.0 to before 2.18.0 | 2.18.0 | Patch available | GHSA-hm36-ffrh-c77c |
- litestar Vendorlitestar-org Affected = 2.17.0 Fixed in — No fix listed CNA
- litestar (PyPI) Vendor— Affected 2.17.0 to before 2.18.0 Fixed in 2.18.0 Patch available GHSA-hm36-ffrh-c77c
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:litestar:litestar:*:*:*:*:*:*:*:* | — | — | litestar-org |
- cpe:2.3:a:litestar:litestar:*:*:*:*:*:*:*:* Versions — — ·litestar-org
Remediation
- Fix · GHSA-hm36-ffrh-c77c litestar (PyPI) Fixed in 2.18.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-59152
- 2026-10-03 Alias added: GHSA-hm36-ffrh-c77c
References
Other 4
- https://github.com/litestar-org/litestar/security/advisories/GHSA-hm36-ffrh-c77c
- https://github.com/litestar-org/litestar/commit/42a89e043e50b515f8548a93954fe143f63cf9fb
- https://github.com/litestar-org/litestar/blob/26f20ac6c52de2b4bf81161f7560c8bb4af6f382/litestar/middleware/rate_limit.py#L127
- https://github.com/litestar-org/litestar
More litestar-org vulnerabilities
- TI-2024-21848 Litestar and Starlite affected by Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVSS 3.1HIGH 8.2
- TI-2024-35241 Litestar allows unbounded resource consumption (DoS vulnerability) CVSS 4.0HIGH 8.2
- TI-2026-35501 Litestar: HTML Injection Through CSRF Token CVSS 3.1HIGH 8.1
- TI-2024-28356 Litestar repository vulnerable to Environment Variable injection in `docs-preview.yml` workflow CVSS 3.1HIGH 8.3
- TI-2026-35502 Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header CVSS 3.1MEDIUM 5.9
- TI-2026-20591 FileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD) CVSS 3.1MEDIUM 6.5
Sources
- CVE-2025-59152 · CVE Program
- CVE-2025-59152 · NVD
- FIRST EPSS
- GHSA-hm36-ffrh-c77c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences