Rate Limiting Vulnerability in Eclipse API Gateway

CVE-2026-110723

What is CVE-2026-110723?

In the API Gateway versions up to 1.7.3, a significant vulnerability exists within the default rate-limit key resolver, known as ClientIpKeyResolver. This resolver generates the per-client bucket key based solely on the leftmost element of the X-Forwarded-For HTTP header, which is directly supplied by the originating client without any validation against a trusted proxy list. Consequently, a malicious actor can exploit this oversight to garner an unlimited number of independent rate-limit buckets, effectively circumventing the gateway's request-rate limiting. This enables an attacker to flood the gateway with requests across all routes that rely on the default configuration, leading to potential service disruptions and abuse of the API services.

References