Lemmy: Rate limit bypass via X-Forwarded-For header spoofing in actix-web ConnectionInfo
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, actix-web ConnectionInfo::realip_remote_addr reads the first value of X-Forwarded-For as the client address used by raw_ip_key in crates/utils/src/rate_limit/mod.rs. Lemmy's bundled docker/nginx.conf uses $proxy_add_x_forwarded_for instead of $remote_addr, which appends the real client address to an X-Forwarded-For value supplied by the client. An unauthenticated attacker can therefore place a different spoofed address first on each request and receive a new rate-limit bucket, bypassing limits on POST /api/v4/account/auth/register, POST /api/v4/account/auth/login, POST /api/v4/post, POST /api/v4/comment, GET /api/v4/search, POST /api/v4/image, and POST /api/v4/account/import_settings. This permits excessive account creation, brute-force attempts, spam, scraping, uploads, and repeated imports. This issue is fixed in versions 0.19.19 and 1.0.0-beta.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA lemmy (LemmyNet) Fixed in 0.19.19, 1.0.0-beta.1
Timeline
- 2026-10-02 Threatist record created from CVE-2026-54738
References
Other 8
- https://github.com/LemmyNet/lemmy/security/advisories/GHSA-2hrg-7x4g-9vpg
- https://github.com/LemmyNet/lemmy/pull/6574
- https://github.com/LemmyNet/lemmy/pull/6575
- https://github.com/LemmyNet/lemmy/commit/41513c89ceecee719bff05acfe613e3b1e85f23c
- https://github.com/LemmyNet/lemmy/commit/8b5b2aa78417b53ff3622c01f5bed2f1590f3b82
- https://github.com/LemmyNet/lemmy/releases/tag/0.19.19
- https://github.com/LemmyNet/lemmy/releases/tag/1.0.0-beta.1
- https://join-lemmy.org/news/2026-06-09_-_Lemmy_Release_v0.19.19
More LemmyNet vulnerabilities
- TI-2026-23295 Lemmy: Unauthenticated SSRF via file_type query parameter injection in image endpoint CVSS 4.0HIGH 7.7
- TI-2026-26073 Lemmy's Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid() CVSS 3.1MEDIUM 6.5
- TI-2026-39555 Lemmy: Stored XSS via markdown image alt-text in lemmy-ui html5-embed CVSS 4.0MEDIUM 6.4
- TI-2026-39552 Lemmy: Lower-ranked federated moderator can remove higher-ranked moderators CVSS 3.1MEDIUM 6.5
- TI-2026-30504 Lemmy: SSRF and internal image disclosure in post link metadata via unvalidated og:image CVSS 3.1MEDIUM 6.5
- TI-2026-39553 Lemmy: Blocked users can edit private messages sent before the block CVSS 4.0MEDIUM 5.3
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences