Vulnerability in Echo Web Framework Impacting Rate Limiting Features

CVE-2026-118653

What is CVE-2026-118653?

A vulnerability exists in the Echo web framework versions 4.0.0 to 5.1.0 that allows remote attackers to circumvent IP-based rate limiting controls. When Echo.IPExtractor is unset, the framework defaults to using client-supplied values from the X-Forwarded-For or X-Real-IP headers to identify clients. This flaw allows attackers to manipulate these headers to rotate through arbitrary IP addresses, potentially evading security controls meant to mitigate brute-force attacks and excessive request volume. The issue has been addressed in Echo version 5.1.0, which improves the handling of client identifiers.

References