Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration

影響: go:github.com/labstack/echo/v5 < 5.1.0 → 5.1.0, go:github.com/labstack/echo/v4 >= 4.0.0, <= 4.16.2

When echo.New() is used without explicitly setting Echo#IPExtractor, the RealIP() method falls back to reading the client-supplied X-Forwarded-For (or X-Real-IP) header without any proxy-origin validation. The default RateLimiter() middleware derives its per-client identifier from ctx.RealIP(), so an attacker can rotate arbitrary values in the X-Forwarded-For header on each request to obtain a fresh rate-limit bucket and bypass IP-based throttling entirely. Affected Component - context.go — (Co…

在 GitHub Advisory Database 阅读

2026/10/29 04:53，GitHub Advisory Database 发布了“Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：Go、GitHub。CVE：CVE-2026-118653。