Threats tagged 'ghsa-qx92-7q4c-w2x8'

CVE-2026-110724 is a vulnerability in Eclipse Connected Services Platform's api-gateway component up to version 1.7.3. The default rate-limit key resolver uses the leftmost element of the X-Forwarded-For header to identify clients, but this header value is not validated against trusted proxies. This allows an attacker to bypass rate limiting by supplying unique header values, effectively obtaining unlimited independent rate-limit buckets.