Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In version 2.17.0, rate limits can be completely bypassed by manipulating the X-Forwarded-For header. This renders IP-based rate limiting ineffective against determined attackers. Litestar's RateLimitMiddleware uses `cache_key_from_request()` to generate cache keys for rate limiting. When an X-Forwarded-For header is present, the middleware trusts it unconditionally and uses its value as part of the client identifier. Since clients can set arbitrary X-Forwarded-For values, each different spoofed IP creates a separate rate limit bucket. An attacker can rotate through different header values to avoid hitting any single bucket's limit. This affects any Litestar application using RateLimitMiddleware with default settings, which likely includes most applications that implement rate limiting. Version 2.18.0 contains a patch for the vulnerability.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In version 2.17.0, rate limits can     be completely bypassed by manipulating the X-Forwarded-For header. This renders IP-based rate limiting     ineffective against determined attackers. Litestar's RateLimitMiddleware uses `cache_key_from_request()`     to generate cache keys for rate limiting. When an X-Forwarded-For header is present, the middleware trusts     it unconditionally and uses its value as part of the client identifier. Since clients can set arbitrary     X-Forwarded-For values, each different spoofed IP creates a separate rate limit bucket. An attacker can     rotate through different header values to avoid hitting any single bucket's limit. This affects any     Litestar application using RateLimitMiddleware with default settings, which likely includes most     applications that implement rate limiting. Version 2.18.0 contains a patch for the vulnerability.
    (CVE-2025-59152)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In version 2.17.0, rate limits can
    be completely bypassed by manipulating the X-Forwarded-For header. This renders IP-based rate limiting
    ineffective against determined attackers. Litestar's RateLimitMiddleware uses `cache_key_from_request()`
    to generate cache keys for rate limiting. When an X-Forwarded-For header is present, the middleware trusts
    it unconditionally and uses its value as part of the client identifier. Since clients can set arbitrary
    X-Forwarded-For values, each different spoofed IP creates a separate rate limit bucket. An attacker can
    rotate through different header values to avoid hitting any single bucket's limit. This affects any
    Litestar application using RateLimitMiddleware with default settings, which likely includes most
    applications that implement rate limiting. Version 2.18.0 contains a patch for the vulnerability.
    (CVE-2025-59152)

ID	Name	Product	Family	Type	Severity
269315	Linux Distros Unpatched Vulnerability : CVE-2025-59152	Nessus	Misc.	Local	high
435517	SCA: security update for litestar (GHSA-hm36-ffrh-c77c)	Tenable Cloud Security	SCA Checks	Local	high
435517	SCA: security update for litestar (GHSA-hm36-ffrh-c77c)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2025-59152

high

Tenable Plugins

high

high

high