What is CVE-2025-59152?

CVE-2025-59152 is a high-severity vulnerability in Litestar-org Litestar, classified under CWE-807. CVSS score: 7.5/10. Published 2025-10-06.

How severe is CVE-2025-59152?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Litestar-org Litestar

CVE-2025-59152

Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In version 2.17.0, rate limits can be completely bypassed by manipulating the X-Forwarded-For header. This renders IP-based rate limiting ineffective against determined…

EPSS: 0.001 (19.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Litestar-org Litestar — versions = 2.17.0

Weakness classification (CWE)

CWE-807

References

https://github.com/litestar-org/litestar/security/advisories/GHSA-hm36-ffrh-c77c (x_refsource_CONFIRM)
https://github.com/litestar-org/litestar/commit/42a89e043e50b515f8548a93954fe143f63cf9fb (x_refsource_MISC)
https://github.com/litestar-org/litestar/blob/26f20ac6c52de2b4bf81161f7560c8bb4af6f382/litestar/middleware/rate_limit.py#L127 (x_refsource_MISC)

Frequently asked questions

What is CVE-2025-59152?: CVE-2025-59152 is a high-severity vulnerability in Litestar-org Litestar, classified under CWE-807. CVSS score: 7.5/10. Published 2025-10-06.
How severe is CVE-2025-59152?: High severity. CVSS v3 base score is 7.5 out of 10.