CWE-348

Action Pack: Possible IP spoofing in Action Dispatch RemoteIp

rails · rails

Symfony: Inline Fragments Let Untrusted Forwarded Headers Set the Host, Scheme and Port of the URLs Generated for the Main Request

sensiolabs · symfony

Remark42: Rate limit bypass via unconditional trust of X-Forwarded-For/X-Real-IP headers in direct-internet deployment

umputun · remark42

ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` header

mayswind · ezbookkeeping

CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, self_url, virtual_host and virtual_port

CGI

PipesHub before 0.10.0 Rate Limit Bypass via Spoofed X-Forwarded-For Header

pipeshub-ai · pipeshub-ai

Echo: X-Real-IP extractor trusts the header value instead of the sending peer

labstack · echo

Use of Less Trusted Source in GitLab

GitLab · GitLab

Use of Less Trusted Source in hMailServer

Progressive Robot Ltd · hMailServer

Chi Client IP Spoofing in ClientIPFromXFF via X-Forwarded-For

go-chi · chi