Executive brief
Litestar X-Forwarded-For Header Spoofing Vulnerability Enables Rate Limit Evasion
Affected products
- PyPI litestar
Junglewise Threat Intelligence
CVE-2025-59152: PYSEC-2026-1553 - Litestar X-Forwarded-For Header Spoofing Vulnerability Enables Rate Limit Evasion
CVE-2025-59152 · Severity: low · CVSS 3.1 · Published 2026-07-07
Technologies: litestar (PyPI). Vendors: PyPI.
Related threats
- Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In versions prior to 2.22.0, an attacker can bypass the allowed hosts
- Litestar XSS via CSRF token injection in templates
- PYSEC-2026-2605 - Litestar and Starlite vulnerable to Path Traversal
- PYSEC-2026-1944 - Litestar allows unbounded resource consumption (DoS vulnerability)
- PYSEC-2026-2197 - Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, FileStore maps cache keys to filenames using Unicode