Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration

影響: go:github.com/labstack/echo/v5 < 5.1.0 → 5.1.0, go:github.com/labstack/echo/v4 >= 4.0.0, <= 4.16.2

When echo.New() is used without explicitly setting Echo#IPExtractor, the RealIP() method falls back to reading the client-supplied X-Forwarded-For (or X-Real-IP) header without any proxy-origin validation. The default RateLimiter() middleware derives its per-client identifier from ctx.RealIP(), so an attacker can rotate arbitrary values in the X-Forwarded-For header on each request to obtain a fresh rate-limit bucket and bypass IP-based throttling entirely. Affected Component - context.go — (Co…

GitHub Advisory Databaseで読む

2026/10/29 04:53、GitHub Advisory Databaseが「Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: Go、GitHub。CVE: CVE-2026-118653。