In "api-gateway" versions till "1.7.3", The default rate-limit key resolver, "ClientIpKeyResolver", derives the per-client bucket key from the leftmost element of the "X-Forwarded-For" request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.