{"id":"ghsa-ghsa-246p-cpwv-v3jq","seq":2056988,"kind":"advisory","title":"Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration","url":"https://github.com/advisories/GHSA-246p-cpwv-v3jq","permalink":"https://vulnpulse.app/items/ghsa-ghsa-246p-cpwv-v3jq","summary":"影響: go:github.com/labstack/echo/v5 < 5.1.0 → 5.1.0, go:github.com/labstack/echo/v4 >= 4.0.0, <= 4.16.2\nWhen echo.New() is used without explicitly setting Echo#IPExtractor, the RealIP() method falls back to reading the client-supplied X-Forwarded-For (or X-Real-IP) header without any proxy-origin validation. The default RateLimiter() middleware derives its per-client identifier from ctx.RealIP(), so an attacker can rotate arbitrary values in the X-Forwarded-For header on each request to obtain a fresh rate-limit bucket and bypass IP-based throttling entirely. Affected Component - context.go — (Co…","severity":"medium","techs":["go","github"],"cves":["CVE-2026-118653"],"tags":["GHSA-246p-cpwv-v3jq","github.com/labstack/echo/v5","github.com/labstack/echo/v4"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T19:53:47.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}