UBUNTU-CVE-2026-118653: Medium severity ubuntu/golang-github-labstack-echo.v2 vulnerability
Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-Forwarded-For or X-Real-IP values when Echo.IPExtractor is unset, and the default RateLimiter uses that result as its client identifier. A remote attacker can rotate arbitrary forwarded-address values to obtain new rate-limit buckets and bypass IP-based throttling used for controls such as brute-force or request-volume protection. This issue is fixed in Echo v5.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Echoto a version that resolves this vulnerability.Fixed in 5.1.0
Frequently Asked Questions
When is an application exposed to this rate-limit bypass?
It is exposed when it uses Echo's default RateLimiter for IP-based throttling and leaves Echo.IPExtractor unset. In that configuration, client-controlled X-Forwarded-For or X-Real-IP values can determine the rate-limit client identifier.
What does an attacker need to bypass throttling?
The attacker only needs remote access to the application and the ability to send requests with arbitrary X-Forwarded-For or X-Real-IP header values. By changing those values between requests, the attacker can obtain separate rate-limit buckets.
Are applications using the default configuration affected?
Yes, the vulnerable behavior occurs when Echo.IPExtractor is unset, which causes Context.RealIP to fall back to forwarded-address headers. The default RateLimiter then uses that result as its client identifier.
What is the available remediation?
Upgrade Echo to v5.1.0, where this issue is fixed. If an immediate upgrade is not possible, avoid leaving Echo.IPExtractor unset when IP-based rate limiting is relied upon.