CVE-2026-118653

Name of the Vulnerable Software and Affected Versions Echo versions 4.0.0 through 5.0.9

Description When Echo.IPExtractor is not explicitly set, the Context.RealIP() function falls back to reading client-supplied X-Forwarded-For or X-Real-IP headers without validating the proxy origin. Because the default RateLimiter() middleware uses Context.RealIP() to identify clients, a remote attacker can rotate arbitrary values in these headers to obtain new rate-limit buckets. This allows the attacker to bypass IP-based throttling used for request-volume protection and security controls such as brute-force prevention on login or password reset endpoints.

Technical details include:

Recommendations Update Echo to version 5.1.0. As a temporary workaround, explicitly configure Echo.IPExtractor using echo.ExtractIPDirect() for non-proxied deployments or echo.ExtractIPFromXFFHeader() for deployments behind trusted proxies. Alternatively, set RateLimiterConfig.IdentifierExtractor to use an identifier that cannot be controlled by the client.