2 Nov 2026 21:57:16 UTC
Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration
cve-program · CVE-2026-118653 · Published
CVE-2026-118653
Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration
CVSS 3.1 5.3 MEDIUMCheck source for fixed versionsKEV status unknown
Historical advisory recorded 2 Nov 2026 21:57:16 UTC. Read the latest advisory.
cve-program · CVE-2026-118653
PublishedEcho is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-Forwarded-For or X-Real-IP values when Echo.IPExtractor is unset, and the default RateLimiter uses that result as its client identifier. A remote attacker can rotate arbitrary forwarded-address values to obtain new rate-limit buckets and bypass IP-based throttling used for controls such as brute-force or request-volume protection. This issue is fixed in Echo v5.1.0.
Read the publisher's advisoryAffected versions, risk and source history
Advisory history
2 saved versionsSee how the publisher's advisory changed over time. Each link opens the version saved at that time. The publisher's update date can differ from the date shown here.
How advisory history works
Each link identifies one complete publisher record. History can include advisories that previously shared an identifier; an identifier removed by a publisher no longer establishes a current relationship. A historical link shows only that record and earlier saved versions. Failed checks and unchanged reads do not create new versions.
28 Oct 2026 20:55:13 UTC
Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration
cve-program · CVE-2026-118653 · Published
This historical link shows only this version and versions saved before it. Browse all advisory history.