CVE-2026-54738: Lemmy: Rate limit bypass via X-Forwarded-For header spoofing in actix-web ConnectionInfo
Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, actix-web ConnectionInfo::realipremoteaddr reads the first value of X-Forwarded-For as the client address used by rawipkey in crates/utils/src/ratelimit/mod.rs. Lemmy's bundled docker/nginx.conf uses $proxyaddxforwardedfor instead of $remoteaddr, which appends the real client address to an X-Forwarded-For value supplied by the client. An unauthenticated attacker can therefore place a different spoofed address first on each request and receive a new rate-limit bucket, bypassing limits on POST /api/v4/account/auth/register, POST /api/v4/account/auth/login, POST /api/v4/post, POST /api/v4/comment, GET /api/v4/search, POST /api/v4/image, and POST /api/v4/account/importsettings. This permits excessive account creation, brute-force attempts, spam, scraping, uploads, and repeated imports. This issue is fixed in versions 0.19.19 and 1.0.0-beta.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
actix-webto a version that resolves this vulnerability.Fixed in 0.19.19 - Upgrade
Upgrade
actix-webto a version that resolves this vulnerability.Fixed in 1.0.0-beta.1
Event History
Frequently Asked Questions
Which deployments are exposed to this rate-limit bypass?
Lemmy deployments running versions before 0.19.19 or 1.0.0-beta.1 are affected when the client address used for rate limiting can be influenced through X-Forwarded-For. The bundled docker/nginx.conf configuration is specifically affected because it appends the real address to a client-supplied X-Forwarded-For header.
Does exploitation require an account or user interaction?
No. An unauthenticated attacker can send requests with a spoofed address as the first X-Forwarded-For value and change it on each request to obtain new rate-limit buckets.
What abuse should be investigated if a vulnerable instance was exposed?
Review activity on registration, login, post, comment, search, image upload, and account-settings import endpoints for volumes that exceed expected per-client limits. The bypass can enable excessive account creation, login brute-force attempts, spam, scraping, uploads, and repeated imports.
What versions contain the fix?
Upgrade to Lemmy 0.19.19 or 1.0.0-beta.1. These versions fix the handling that allowed the first X-Forwarded-For value to determine the rate-limit client address.