Rate Limiting Bypass in Litestar ASGI Framework by Manipulating X-Forwarded-For Header

CVE-2025-59152

What is CVE-2025-59152?

The Litestar ASGI framework has a vulnerability in version 2.17.0 where the RateLimitMiddleware does not properly validate the X-Forwarded-For header, allowing attackers to bypass rate limits. This occurs because the middleware trusts the header and utilizes its value as part of the client identifier, enabling attackers to spoof IP addresses and effectively escape IP-based rate limiting. As different spoofed IP values create unique rate limit buckets, an attacker can manipulate these headers to rotate between them, thus avoiding limit thresholds. A fix is available in version 2.18.0.

References