litestar 2.17.0 Header cache_key_from_request X-Forwarded-For reliance on untrusted inputs in a security decision

Summaryinfo

A vulnerability, which was classified as problematic, has been found in litestar 2.17.0. The impacted element is the function cache_key_from_request of the component Header Handler. Performing a manipulation of the argument X-Forwarded-For results in reliance on untrusted inputs in a security decision. This vulnerability is cataloged as CVE-2025-59152. It is possible to initiate the attack remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in litestar 2.17.0. This affects the function cache_key_from_request of the component Header Handler. The manipulation of the argument X-Forwarded-For with an unknown input leads to a reliance on untrusted inputs in a security decision vulnerability. CWE is classifying the issue as CWE-807. The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism. This is going to have an impact on availability. The summary by CVE is:

Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In version 2.17.0, rate limits can be completely bypassed by manipulating the X-Forwarded-For header. This renders IP-based rate limiting ineffective against determined attackers. Litestar's RateLimitMiddleware uses `cache_key_from_request()` to generate cache keys for rate limiting. When an X-Forwarded-For header is present, the middleware trusts it unconditionally and uses its value as part of the client identifier. Since clients can set arbitrary X-Forwarded-For values, each different spoofed IP creates a separate rate limit bucket. An attacker can rotate through different header values to avoid hitting any single bucket's limit. This affects any Litestar application using RateLimitMiddleware with default settings, which likely includes most applications that implement rate limiting. Version 2.18.0 contains a patch for the vulnerability.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2025-59152 since 09/09/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 2.18.0 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• litestar

Version

• 2.17.0

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion