{"affected":[{"product":"echo","source":"CNA: GitHub_M","vendor":"labstack","versions":[{"status":"affected","version":">= 4.0.0, < 5.1.0"}]},{"defaultStatus":"unaffected","ecosystem":"Go","packageName":"github.com/labstack/echo/v5","product":"github.com/labstack/echo/v5","source":"OSV GHSA-246p-cpwv-v3jq","vendor":"","versions":[{"events":[{"introduced":"0"},{"fixed":"5.1.0"}],"lessThan":"5.1.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"Go","packageName":"github.com/labstack/echo/v4","product":"github.com/labstack/echo/v4","source":"OSV GHSA-246p-cpwv-v3jq","vendor":"","versions":[{"events":[{"introduced":"4.0.0"},{"last_affected":"4.16.2"}],"lessThanOrEqual":"4.16.2","status":"affected","version":"4.0.0","versionType":"semver"}]}],"cveId":"CVE-2026-118653","cwes":["CWE-290"],"description":"Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-Forwarded-For or X-Real-IP values when Echo.IPExtractor is unset, and the default RateLimiter uses that result as its client identifier. A remote attacker can rotate arbitrary forwarded-address values to obtain new rate-limit buckets and bypass IP-based throttling used for controls such as brute-force or request-volume protection. This issue is fixed in Echo v5.1.0.","epss":{"date":"2026-11-02","percentile":0.35827,"score":0.00415},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/labstack/echo/security/advisories/GHSA-246p-cpwv-v3jq"}],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"}],"modifiedAt":1793652109060,"publishedAt":1793216525556,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/labstack/echo/security/advisories/GHSA-246p-cpwv-v3jq"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/labstack/echo/commit/22e4b71109ef072ef011a489066ec662ca9565b2"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/labstack/echo/releases/tag/v5.1.0"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/labstack/echo/security/advisories/GHSA-246p-cpwv-v3jq"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-246p-cpwv-v3jq"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-246p-cpwv-v3jq"}],"remediation":[{"kind":"fix","source":"OSV GHSA-246p-cpwv-v3jq","text":"github.com/labstack/echo/v5 (Go): OSV reports a fixed version 5.1.0. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-246p-cpwv-v3jq"}],"revision":"b63354213bb602d1de0aecf8a0855f22ad273f1487beb01f54952e7df727f9d3","sources":[{"modifiedAt":1793652109060,"name":"CNA: GitHub_M","retrievedAt":1793653768914,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118653"},{"modifiedAt":1793217603857,"name":"OSV / GitHub Security Advisories","retrievedAt":1793653771400,"url":"https://osv.dev/vulnerability/GHSA-246p-cpwv-v3jq"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793653774445,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-118653"}],"ssvc":{"assessedAt":1793652084678,"automatable":"yes","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration","updatedAt":1793653774445}