Rate Limiting Bypass Vulnerability in Eclipse API Gateway

CVE-2026-110724

What is CVE-2026-110724?

The Eclipse API Gateway's default rate-limit key resolver, 'ClientIpKeyResolver', creates per-client bucket keys based on the first element of the 'X-Forwarded-For' request header. Since this header element is determined by the HTTP client and lacks validation against a trusted-proxy list, attackers can strategically manipulate it to gain access to an unlimited number of rate-limit buckets. This exploitation allows an attacker to bypass the gateway's rate limiting protections, impacting the security and availability of the application.

References