Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration

影響: go:github.com/labstack/echo/v5 < 5.1.0 → 5.1.0, go:github.com/labstack/echo/v4 >= 4.0.0, <= 4.16.2

When echo.New() is used without explicitly setting Echo#IPExtractor, the RealIP() method falls back to reading the client-supplied X-Forwarded-For (or X-Real-IP) header without any proxy-origin validation. The default RateLimiter() middleware derives its per-client identifier from ctx.RealIP(), so an attacker can rotate arbitrary values in the X-Forwarded-For header on each request to obtain a fresh rate-limit bucket and bypass IP-based throttling entirely. Affected Component - context.go — (Co…

Read on GitHub Advisory Database

On 10/29/2026, 04:53 AM, GitHub Advisory Database published "Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration" (type: Advisory). Severity is "Medium" (medium). Related technologies: Go, GitHub. CVE: CVE-2026-118653.