CVE-2026-110724

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-110724
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110724.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-110724
Aliases
  • GHSA-4j9j-mx7g-p9p6
Published
2026-10-15T12:11:22Z
Modified
2026-10-17T02:48:07Z
Summary
[none]
Details

In api-gateway versions till 1.7.3, The default rate-limit key resolver, ClientIpKeyResolver, derives the per-client bucket key from the leftmost element of the X-Forwarded-For request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.

Database specific 
{
    "cna_assigner":  "eclipse",
    "cwe_ids":  [
        "CWE-269",
        "CWE-639",
        "CWE-863"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110724.json"
}
References

Affected packages

Git / github.com/eclipse-ecsp/api-gateway

Affected ranges

Type
GIT
Repo
https://github.com/eclipse-ecsp/api-gateway
Events
Introduced
caea0f89d70317ac5e5a671c15e0c8c952730b60
Last Affected
14e30b93bae820aa35a19e76372fd3cf1a8ab66e
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "1.1.1"
        },
        {
            "last_affected":  "1.7.3"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

1.*
1.1.1
1.2.0
1.2.0-M1
1.2.0-M2
1.2.1
1.2.2
1.2.3
1.3.0
1.3.0-M1
1.3.0-M1.1
1.3.0-M1.2
1.3.1
1.3.2
1.3.3
1.3.4
1.4.0
1.4.0-M1
1.4.0-M2
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.0
1.6.1
1.6.2
1.7.0
1.7.0-M1.1
1.7.1
1.7.2
1.7.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110724.json"