Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied…
Historical advisory recorded 28 Oct 2026 20:57:26 UTC. Read the latest advisory.
nvd · CVE-2026-118653
PublishedEcho is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-Forwarded-For or X-Real-IP values when Echo.IPExtractor is unset, and the default RateLimiter uses that result as its client identifier. A remote attacker can rotate arbitrary forwarded-address values to obtain new rate-limit buckets and bypass IP-based throttling used for controls such as brute-force or request-volume protection. This issue is fixed in Echo v5.1.0.
Read the publisher's advisoryAffected versions, risk and source history
nvd · CVE-2026-118653
PublishedNVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.
Source analysis status: Received
Weakness classifications: CWE-290
Original publisher date fields
published: 2026-10-28T20:17:22.400
lastModified: 2026-10-28T20:17:22.400
No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.
Original source record · Cite this exact observation · Complete original publisher JSON