CVE-2026-54738

Name of the Vulnerable Software and Affected Versions Lemmy versions prior to 0.19.19 Lemmy versions prior to 1.0.0-beta.1

Description An issue exists where the ConnectionInfo::realip remote addr function in actix-web reads the first value of the X-Forwarded-For header as the client address used by raw ip key in crates/utils/src/rate limit/mod.rs. Because the bundled docker/nginx.conf uses $proxy add x forwarded for instead of $remote addr, it appends the real client address to any X-Forwarded-For value provided by the client. An unauthenticated attacker can spoof the address in each request to obtain a new rate-limit bucket, bypassing restrictions on the following endpoints:

This allows for excessive account creation, brute-force attacks, spam, scraping, unauthorized uploads, and repeated imports.

Recommendations Update to version 0.19.19. Update to version 1.0.0-beta.1.