## Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration

- 種別: advisory
- 重大度: medium
- 関連技術: go, github
- CVE: CVE-2026-118653
- 公開日時: 2026-10-28T19:53:47.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-246p-cpwv-v3jq)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-246p-cpwv-v3jq

影響: go:github.com/labstack/echo/v5 < 5.1.0 → 5.1.0, go:github.com/labstack/echo/v4 >= 4.0.0, <= 4.16.2
When echo.New() is used without explicitly setting Echo#IPExtractor, the RealIP() method falls back to reading the client-supplied X-Forwarded-For (or X-Real-IP) header without any proxy-origin validation. The default RateLimiter() middleware derives its per-client identifier from ctx.RealIP(), so an attacker can rotate arbitrary values in the X-Forwarded-For header on each request to obtain a fresh rate-limit bucket and bypass IP-based throttling entirely. Affected Component - context.go — (Co…