CVE-2026-54738

Received Received - Intake

HTTP Header Injection in Lemmy

Publication date: 2026-08-19

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, actix-web ConnectionInfo::realip_remote_addr reads the first value of X-Forwarded-For as the client address used by raw_ip_key in crates/utils/src/rate_limit/mod.rs. Lemmy's bundled docker/nginx.conf uses $proxy_add_x_forwarded_for instead of $remote_addr, which appends the real client address to an X-Forwarded-For value supplied by the client. An unauthenticated attacker can therefore place a different spoofed address first on each request and receive a new rate-limit bucket, bypassing limits on POST /api/v4/account/auth/register, POST /api/v4/account/auth/login, POST /api/v4/post, POST /api/v4/comment, GET /api/v4/search, POST /api/v4/image, and POST /api/v4/account/import_settings. This permits excessive account creation, brute-force attempts, spam, scraping, uploads, and repeated imports. This issue is fixed in versions 0.19.19 and 1.0.0-beta.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-21

Generated

2026-09-09

AI Q&A

2026-08-20

EPSS Evaluated

2026-09-07

NVD

CVE-2026-54738

EUVD

EUVD-2026-62850

Affected Vendors & Products

Vendor	Product	Version / Range
lemmy	lemmy	to 0.19.19 (inc)
lemmy	lemmy	to 1.0.0-beta.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-799	The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests.

Attack-Flow Graph

Executive Summary

Lemmy versions before 0.19.19 and 1.0.0-beta.1 have a rate-limiting bypass vulnerability. The system uses the first value in the X-Forwarded-For header as the client address for rate limiting. However, the default nginx configuration appends the real client address to this header, allowing attackers to spoof different addresses in each request. This lets them create new rate-limit buckets and bypass restrictions on actions like account creation, login, posting, and searching.

Detection Guidance

Check Lemmy server logs for unusual patterns in requests to the affected endpoints like /api/v4/account/auth/register or /api/v4/post. Look for multiple requests from the same client IP with varying X-Forwarded-For headers. Monitor rate limiting bypass attempts by tracking excessive requests from single sources.

Impact Analysis

An attacker could exploit this to create many fake accounts, perform brute-force attacks on logins, spam posts or comments, scrape content, upload excessive files, or repeatedly import settings. This could degrade service performance, disrupt legitimate users, and potentially lead to account lockouts or data corruption.

Compliance Impact

This vulnerability allows unauthenticated attackers to bypass rate limits, potentially enabling excessive account creation, brute-force attempts, spam, scraping, or uploads. While not directly violating GDPR or HIPAA, it could indirectly impact compliance by enabling unauthorized data processing, excessive data collection, or facilitating attacks that compromise user data integrity or confidentiality.

Mitigation Strategies

Upgrade Lemmy to version 0.19.19 or 1.0.0-beta.1 or later. Update the nginx configuration to use $remote_addr instead of $proxy_add_x_forwarded_for in the proxy_set_header directive. Review and adjust rate limiting rules for the affected endpoints to prevent abuse.

Hi! I’m here to help you understand CVE-2026-54738. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70