CVE-2026-110726
In versions till , The default rate-limit key resolver, , derives the per-client bucket key from the leftmost element of the request header.
Published Oct 15, 2026 · updated Oct 15, 2026 · Eclipse Foundation Eclipse Connected Services Platform
In versions till , The default rate-limit key resolver, , derives the per-client bucket key from the leftmost element of the request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.
Timeline
Detection, updates, and resolution for this record.
Oct 15, 2026 · NIST NVD
Detected
In versions till , The default rate-limit key resolver, , derives the per-client bucket key from the leftmost element of the request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the
Affected
- vendor Eclipse Foundation Eclipse Connected Services Platformversion unspecified
Sources
- CVE.orgCVE-2026-110726
In versions till , The default rate-limit key resolver, , derives the per-client bucket key from the leftmost element of the request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefor
cve.org - NIST NVDCVE-2026-110726
In versions till , The default rate-limit key resolver, , derives the per-client bucket key from the leftmost element of the request header. That element is supplied by the originating HTTP client and is not validated ag
nvd.nist.gov