[GH-ISSUE #1048] Rate-Topics can be used to DoS individual (public) topics #736

New issue

Closed

opened 2026-05-07 00:27:01 +02:00 by BreizhHardware · 1 comment

BreizhHardware commented

2026-05-07 00:27:01 +02:00

Owner

Originally created by @binwiederhier on GitHub (Mar 7, 2024).
Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/1048

The attack is this:

Subscribe to mytopic with the rate topics header including "mytopic"
Everyone who subscribes to that topic will count towards that one IPs 250 message limit
After 250 messages, done

I will remove the rate-topics header entirely as a result, and just enable visitor rate limiting for "up*" topics.

Originally created by @binwiederhier on GitHub (Mar 7, 2024). Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/1048 The attack is this: - Subscribe to mytopic with the rate topics header including "mytopic" - Everyone who subscribes to that topic will count towards that one IPs 250 message limit - After 250 messages, done I will remove the rate-topics header entirely as a result, and just enable visitor rate limiting for "up*" topics.