No access to your tenant or devices. Every item links to its source. What this means
Historical advisory recorded 2 Nov 2026 21:57:16 UTC. Read the latest advisory.
Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-Forwarded-For or X-Real-IP values when Echo.IPExtractor is unset, and the default RateLimiter uses that result as its client identifier. A remote attacker can rotate arbitrary forwarded-address values to obtain new rate-limit buckets and bypass IP-based throttling used for controls such as brute-force or request-volume protection. This issue is fixed in Echo v5.1.0.
Read the publisher's advisoryVendor product
Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "labstack",
"product": "echo",
"versions": [
{
"version": ">= 4.0.0, < 5.1.0",
"status": "affected"
}
]
}Original source record · Cite this exact observation · Complete original publisher JSON