CVE-2025-57816: Ethyca Fides Rate Limiting Vulnerability in Proxied Environments
Summary
CVE-2025-57816: Fides Webserver API Rate Limiting Vulnerability in Proxied Environments. Affects ethyca-fides versions < 2.69.1. Fixed in 2.69.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ethyca Fides is an open-source data privacy management platform that helps organizations manage their data privacy compliance. It provides features such as consent management, data subject requests, and privacy impact assessments. However, it has a vulnerability in its built-in rate limiting mechanism, which can be exploited in environments using CDNs, proxies, or load balancers.
Vulnerability Detail
The vulnerability arises from the Fides Webserver API's ineffective IP-based rate limiting, which relies on the immediate connection source IP instead of the actual client IP. Additionally, rate limit counters are stored in-memory per container rather than in a shared store. This allows attackers to bypass rate limits, potentially leading to resource exhaustion and denial of service for legitimate clients by triggering rate limits on infrastructure IPs.
How To Fix
Latest published version: 2.86.2 as of 22 Oct 2026
pip install --upgrade "ethyca-fides==2.86.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.69.1
This is the first release that contains the fix.
pip install --upgrade "ethyca-fides==2.69.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As there are no application-level workarounds, it is recommended to implement rate limiting externally at the infrastructure level using a Web Application Firewall (WAF), API Gateway, or similar technology.
Conclusion
The Ethyca Fides package has a significant vulnerability related to its rate limiting mechanism, which can be exploited in proxied environments. Users are strongly advised to upgrade to the patched version to mitigate risks associated with this vulnerability.
See every vulnerability recorded for ethyca-fides →
FAQ
CVE-2025-57816 is a vulnerability in the Ethyca Fides package that affects its rate limiting mechanism in proxied environments.
The vulnerability allows attackers to bypass rate limits, potentially leading to resource exhaustion and denial of service for legitimate users.
You should upgrade to version 2.69.1 or later to secure your application against this vulnerability.
There are no application-level workarounds, but you can implement external rate limiting using a WAF or API Gateway.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using your Pipfile.lock. You can also check your application against known vulnerabilities using the Vulert playground.
References
Related vulnerabilities
Recent vulnerabilities recorded for ethyca-fides.
