PT-2025-36509 · Fides · Fides

Daveqnet · Published 2025-09-08 · Updated 2025-09-08 · CVE-2025-57816

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Fides versions prior to 2.69.1

Description: Fides is an open-source privacy engineering platform. The built-in IP-based rate limiting in the Fides Webserver API is ineffective in environments utilizing CDNs, proxies, or load balancers. The system incorrectly applies rate limits based on infrastructure IPs instead of client IPs and stores counters in memory rather than a shared store. This allows attackers to bypass rate limits and potentially cause a denial of service. Deployments using external rate limiting solutions are not affected.

Recommendations: Update to version 2.69.1 or later. Implement rate limiting externally at the infrastructure level using a WAF, API Gateway, or similar technology.

Exploit

Fix

DoS

Improper Restriction of Excessive Authentication Attempts

Allocation of Resources Without Limits

Weakness Enumeration

CWE-799

CWE-307

CWE-770

Related Identifiers

CVE-2025-57816

GHSA-FQ34-XW6C-FPHF

Affected Products

Fides

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57816.json · Exploit
• https://github.com/ethyca/fides/security/advisories/GHSA-fq34-xw6c-fphf · Vendor Advisory
• https://github.com/ethyca/fides/commit/59903c195e2f9f8915a1db94950aefd557033a5c · Patch
• https://osv.dev/vulnerability/GHSA-fq34-xw6c-fphf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-57816 · Security Note
• https://osv.dev/vulnerability/CVE-2025-57816 · Vendor Advisory
• https://github.com/ethyca/fides · Note
• https://github.com/ethyca/fides/releases/tag/2.69.1 · Note
• https://twitter.com/CVEnew/status/1965165479967777057 · Twitter Post
• https://t.me/cveNotify/134714 · Telegram Post