Exploitable Rate Limiting Flaw in Lemmy Platform by LemmyNet
CVE-2026-54738
6.5MEDIUM
What is CVE-2026-54738?
A vulnerability in the Lemmy platform, prior to version 0.19.19 and 1.0.0-beta.1, allows unauthenticated attackers to exploit the 'realip_remote_addr' handling in actix-web's ConnectionInfo. By modifying the 'X-Forwarded-For' header, attackers can spoof their IP address, causing the system to allocate a new rate-limit bucket for each request. This flaw enables excessive account creation, brute-force attacks, and spamming on multiple API endpoints, circumventing established rate limits and compromising the integrity of the platform.
Affected Version(s)
lemmy < 0.19.19 < 0.19.19
lemmy >= 1.0.0-alpha.5, < 1.0.0-beta.1 < 1.0.0-alpha.5, 1.0.0-beta.1