The vulnerability exists in api‑gateway versions up to and including 1.7.3. The default ClientIpKeyResolver builds the rate‑limit bucket key from the first element of the X‑Forwarded‑For header, a value that originates from the client and is not validated against a list of trusted proxies. An attacker can set this header to any arbitrary IP string, causing the gateway to create a unique bucket for each value. By doing so, an attacker can generate a large number of independent buckets and effectively bypass the gateway’s per‑client request‑rate limiting on every route that uses the shipped configuration. This leads to a denial‑of‑service scenario where legitimate traffic can be flooded or the gateway can be abused for malicious requests.

The affected software is the Eclipse Connected Services Platform’s api‑gateway component, distributed by the Eclipse Foundation. Versions up to and including 1.7.3 are vulnerable. The issue arises from the default rate‑limit key resolver code bundled with these releases. No other versions are currently known to be affected.

Although the EPSS score indicates a very low probability of exploitation (less than 1%), the attack does not require privileged access and can be performed from any external HTTP client that can inject an X‑Forwarded‑For header. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed public exploits yet. Nonetheless, the potential for a denial‑of‑service or high‑volume attack exists, especially in environments where the gateway is exposed directly to the internet. The CVSS score is 7.5, indicating a high severity.