Vulnerability · CVE-2026-118653
Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration
Published Oct 28, 2026 · catalog updated Oct 28, 2026 · Echo has Rate Limiter
Last checked Nov 4, 2026. A connected source was read within the last 7 days.
Check if you run it
No confirmed exploitation is on record for CVE-2026-118653. EPSS is 0.41%. Act only if a listed version of Echo has Rate Limiter is installed.
Gaps on this record
- The stored product name is a package slug. The name on this page is taken from the title (Echo has Rate Limiter).
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
- Severity
- Medium5.3
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- 0.41%
- Remediation
- Advisory link
- Affected products
- Go github.com/labstack/echo/v4 · Go github.com/labstack/echo/v5 · golang github.com
## Summary When is used without explicitly setting , the method falls back to reading the client-supplied (or ) header without any proxy-origin validation. The default middleware derives its per-client identifier from , so an attacker can rotate arbitrary values in the header on each request to obtain a fresh rate-limit bucket and bypass IP-based throttling entirely. ## Affected Component - — (lines 186–208), legacy fallback branch (lines 190–200) - — (lines 46–58); (lines 71–76) - — (lines 326–343), left by default ## Description ### unconditionally trusts when is unset ( ) first checks . When this field is (the default for ), it falls through to legacy behavior and returns the **first IP** from the header — the position an attacker has full control over: ### Rate limiter default identifier extractor calls unconditionally ( ) sets the identifier extractor to with no guard for whether a safe is configured: ( ) copies directly: The result is that the most common usage pattern — — produces a rate limiter whose per-client identifier is fully controlled by the requester. ### Framework acknowledges the issue for IP extraction but the rate limiter carries no warning explicitly states the default is insecure: > "Note: if you don't set explicitly, Echo fallback to legacy behavior, which is not a good choice." And : > "In default behavior, Echo sees all of first XFF header, X-Real-IP header and IP from network layer. As you might already notice, after reading this article, this is not good. Sole reason this is default is just backward compatibility." The mechanism ( , , ) in exists precisely to close this gap. However, the function and have **no corresponding warning** and make no attempt to detect or flag that is unset, leaving operators who follow the standard rate limiter example silently exposed. The test ( ) itself drives the rate limiter by setting directly on the test request — demonstrating that the identifier is freely injectable without comment or mitigation. ### F
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- Go github.com/labstack/echo/v44.0.0 → 4.16.2
- Go github.com/labstack/echo/v50 → 5.1.0
- golang github.comversion unspecified
How to fix CVE-2026-118653
Upgrade
CVE-2026-118653 lists a fix boundary at 4.16.2. Compare the installed build with that boundary before you change production.
Version check
Fixed in 5.1.0 · 1 other ranges on the advisory
Advisory
Open the cve_org record and follow its fix.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
No confirmed exploitation is on record for CVE-2026-118653. EPSS is 0.41%. Act only if a listed version of Echo has Rate Limiter is installed.
Which versions are affected?
Compare what you have installed with 4.0.0 → 4.16.2, 0 → 5.1.0. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
CWE-290: Authentication Bypass by Spoofing. EPSS 0.41%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 28, 2026 · GitLab Advisory Database
Detected
When echo.New() is used without explicitly setting Echo#IPExtractor, the RealIP() method falls back to reading the client-supplied X-Forwarded-For (or X-Real-IP) header without any proxy-origin validation. The default RateLimiter() middleware derives its per-client identifier from ctx.RealIP(), so an attacker can rotate arbitrary values in the X-Forwarded-For header on each request to obtain a fre
Oct 28, 2026 · Go Vulnerability Database
Fix available
github.com/labstack/echo/v5 fixed in 5.1.0
Oct 28, 2026 · Go Vulnerability Database
Fix available
github.com/labstack/echo/v5 fixed in 5.1.0
Oct 28, 2026 · Go Vulnerability Database
Fix available
github.com/labstack/echo/v4 fixed in 4.16.2
Oct 28, 2026 · Go Vulnerability Database
Updated
## Summary When is used without explicitly setting , the method falls back to reading the client-supplied (or ) header without any proxy-origin validation. The default middleware derives its per-client identifier from , so an attacker can rotate arbitrary values in the header on each request to obtain a fresh rate-limit bucket and bypass IP-based throttling entirely. ## Affected Component - — (lin
Sources
- CVE.orgVulnerability recordCVE-2026-118653
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-118653
30-day exploitation probability 0.41%
first.org - GitLab Advisory DatabasePackage advisoryCVE-2026-118653
When echo.New() is used without explicitly setting Echo#IPExtractor, the RealIP() method falls back to reading the client-supplied X-Forwarded-For (or X-Real-IP) header without any proxy-origin validation. The default RateLimiter() middleware derives its per-client identifier from ctx.RealIP(), so an attacker can rotate arbitrary values in the X-Forwarded-For header on each request to obtain a fre
advisories.gitlab.com - Go Vulnerability DatabasePackage advisoryGHSA-246p-cpwv-v3jq
Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration
osv.dev
References
Freshness
Last verified in this catalog Nov 4, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.
- FIRST EPSSNov 4, 2026
- Go Vulnerability DatabaseOct 30, 2026
- GitLab Advisory DatabaseOct 30, 2026
- CVE.orgOct 29, 2026