Eclipse Connected Services Platform
Monthly
Rate limiting in Eclipse Connected Services Platform's api-gateway (up to and including 1.7.3) can be bypassed completely by any remote attacker who sends a distinct X-Forwarded-For header value on every request, because the shipped default ClientIpKeyResolver builds the per-client rate-limit bucket key from the unvalidated leftmost element of that client-supplied header. The result is an unlimited number of independent buckets on every route that uses the default configuration, letting unauthenticated attackers (CVSS:3.1 AV:N/AC:L/PR:N/UI:N) evade request throttling and degrade availability (C:N/I:N/A:H, score 7.5); confidentiality and integrity are unaffected. Exposure is configuration-dependent - gateways that swap in a trusted-proxy-aware key resolver or do not enforce rate limiting are not impacted, and no public exploit code was identified at time of analysis (SSVC exploitation: none).
Rate-limit bypass in the Eclipse Connected Services Platform api-gateway (affected versions 1.1.1 through 1.7.3) allows any unauthenticated remote client to evade request throttling by rotating the value of the leftmost X-Forwarded-For header element, which the shipped default ClientIpKeyResolver trusts without validation. Because each unique header value produces a fresh rate-limit bucket, an attacker can issue unlimited requests against any route that relies on the default resolver and has rate limiting configured, degrading the availability protections the gateway is meant to enforce. No KEV entry or publicly available exploit code was identified at time of analysis, and EPSS is low (0.15%, 4th percentile); CISA SSVC rates exploitation as 'none' while noting the issue is automatable, so mass scanning should be expected even without a dedicated exploit. The net effect is a moderate-priority security-control bypass (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) rather than a system compromise, with deployments that customize the key resolver or sanitize X-Forwarded-For at a trusted edge proxy unaffected.
Rate limiting in Eclipse Foundation's api-gateway component of the Eclipse Connected Services Platform (versions up to and including 1.7.3) can be completely bypassed by any remote client that varies the X-Forwarded-For header, because the shipped default ClientIpKeyResolver builds each rate-limit bucket key from the unvalidated leftmost element of that client-supplied header, letting one attacker mint an unlimited number of independent buckets and exceed the configured request-rate limits on every route using the default configuration. The vulnerability is a medium-severity (CVSS 6.5) reliance-on-untrusted-source flaw (CWE-348) whose impact is availability-oriented, enabling resource exhaustion and abuse of downstream services; although the vendor vector scores it PR:L, the independent assessment rates it PR:N because spoofing the header requires no authentication at all. There is no CISA KEV entry and no public exploit code identified at time of analysis, but an upstream fix is already public in the project's pull request #330, which shortens the window for attackers to locate and target unpatched, default-configured deployments. Exploitation is conditional: it applies only where the default key resolver is in use, where the attacker can set arbitrary X-Forwarded-For values, and where no trusted-proxy allowlist validates that header.
Rate limiting in Eclipse Connected Services Platform's api-gateway (up to and including 1.7.3) can be bypassed completely by any remote attacker who sends a distinct X-Forwarded-For header value on every request, because the shipped default ClientIpKeyResolver builds the per-client rate-limit bucket key from the unvalidated leftmost element of that client-supplied header. The result is an unlimited number of independent buckets on every route that uses the default configuration, letting unauthenticated attackers (CVSS:3.1 AV:N/AC:L/PR:N/UI:N) evade request throttling and degrade availability (C:N/I:N/A:H, score 7.5); confidentiality and integrity are unaffected. Exposure is configuration-dependent - gateways that swap in a trusted-proxy-aware key resolver or do not enforce rate limiting are not impacted, and no public exploit code was identified at time of analysis (SSVC exploitation: none).
Rate-limit bypass in the Eclipse Connected Services Platform api-gateway (affected versions 1.1.1 through 1.7.3) allows any unauthenticated remote client to evade request throttling by rotating the value of the leftmost X-Forwarded-For header element, which the shipped default ClientIpKeyResolver trusts without validation. Because each unique header value produces a fresh rate-limit bucket, an attacker can issue unlimited requests against any route that relies on the default resolver and has rate limiting configured, degrading the availability protections the gateway is meant to enforce. No KEV entry or publicly available exploit code was identified at time of analysis, and EPSS is low (0.15%, 4th percentile); CISA SSVC rates exploitation as 'none' while noting the issue is automatable, so mass scanning should be expected even without a dedicated exploit. The net effect is a moderate-priority security-control bypass (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) rather than a system compromise, with deployments that customize the key resolver or sanitize X-Forwarded-For at a trusted edge proxy unaffected.
Rate limiting in Eclipse Foundation's api-gateway component of the Eclipse Connected Services Platform (versions up to and including 1.7.3) can be completely bypassed by any remote client that varies the X-Forwarded-For header, because the shipped default ClientIpKeyResolver builds each rate-limit bucket key from the unvalidated leftmost element of that client-supplied header, letting one attacker mint an unlimited number of independent buckets and exceed the configured request-rate limits on every route using the default configuration. The vulnerability is a medium-severity (CVSS 6.5) reliance-on-untrusted-source flaw (CWE-348) whose impact is availability-oriented, enabling resource exhaustion and abuse of downstream services; although the vendor vector scores it PR:L, the independent assessment rates it PR:N because spoofing the header requires no authentication at all. There is no CISA KEV entry and no public exploit code identified at time of analysis, but an upstream fix is already public in the project's pull request #330, which shortens the window for attackers to locate and target unpatched, default-configured deployments. Exploitation is conditional: it applies only where the default key resolver is in use, where the attacker can set arbitrary X-Forwarded-For values, and where no trusted-proxy allowlist validates that header.