PT-2025-36509 · Fides · Fides

Daveqnet · Published 2025-09-08 · Updated 2025-09-08 · CVE-2025-57816

Positive Technologies · (AI Summary)

CVSS v4.0

6.3

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions:

Fides versions prior to 2.69.1

Description:

Fides is an open-source privacy engineering platform. The built-in IP-based rate limiting in the Fides Webserver API is ineffective in environments utilizing CDNs, proxies, or load balancers. The system incorrectly applies rate limits based on infrastructure IPs instead of client IPs and stores counters in memory rather than a shared store. This allows attackers to bypass rate limits and potentially cause a denial of service. Deployments using external rate limiting solutions are not affected.

Recommendations:

Update to version 2.69.1 or later.

Implement rate limiting externally at the infrastructure level using a WAF, API Gateway, or similar technology.

Fix

Weakness Enumeration

CWE-799

Related Identifiers

CVE-2025-57816

Affected Products

Fides

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-57816 · Security Note
• https://github.com/ethyca/fides/commit/59903c195e2f9f8915a1db94950aefd557033a5c · Note
• https://github.com/ethyca/fides/releases/tag/2.69.1 · Note
• https://github.com/ethyca/fides/security/advisories/GHSA-fq34-xw6c-fphf · Note
• https://twitter.com/CVEnew/status/1965165479967777057 · Twitter Post