PT-2025-40902 · Litestar · Litestar

Crum7 · Published 2025-10-06 · Updated 2025-10-06 · CVE-2025-59152

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Litestar versions prior to 2.18.0

Description Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In version 2.17.0, rate limits can be bypassed by manipulating the X-Forwarded-For header. The RateLimitMiddleware uses cache key from request() to generate cache keys for rate limiting. When an X-Forwarded-For header is present, the middleware trusts it unconditionally and uses its value as part of the client identifier. Attackers can rotate through different header values to avoid rate limits. This affects Litestar applications using RateLimitMiddleware with default settings.

Recommendations Update to Litestar version 2.18.0 or later.

Exploit

Fix

Weakness Enumeration

CWE-807

Related Identifiers

CVE-2025-59152

GHSA-HM36-FFRH-C77C

Affected Products

Litestar

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59152.json · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-59152 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-59152 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-59152 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-59152 · Security Note
• https://ubuntu.com/security/CVE-2025-59152 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hm36-ffrh-c77c · Vendor Advisory
• https://github.com/litestar-org/litestar · Note
• https://github.com/litestar-org/litestar/security/advisories/GHSA-hm36-ffrh-c77c · Note
• https://github.com/litestar-org/litestar/blob/26f20ac6c52de2b4bf81161f7560c8bb4af6f382/litestar/middleware/rate_limit.py#L127 · Note
• https://github.com/litestar-org/litestar/commit/42a89e043e50b515f8548a93954fe143f63cf9fb · Note
• https://twitter.com/VulmonFeeds/status/1975247972741833188 · Twitter Post
• https://twitter.com/CVEnew/status/1975227281758171362 · Twitter Post
• https://t.me/cveNotify/137523 · Telegram Post