Is CVE-2026-118653 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118653 being exploited in the wild.

How severe is CVE-2026-118653?

Medium severity, with a CVSS score of 5.3, published 28 October 2026.

Which products and versions are affected?

github.com/labstack/echo/v4 (Go) >= 4.0.0, <= 4.16.2, SEMVER:introduced=4.0.0, SEMVER:introduced=4.0.0,last_affected=4.16.2; github.com/labstack/echo/v5 (Go) < 5.1.0, SEMVER:introduced=0,fixed=5.1.0; Labstack Echo 4.0.0 through 5.0.x.

How is CVE-2026-118653 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-118653?

Check whether you run github.com/labstack/echo/v4 (Go), github.com/labstack/echo/v5 (Go) or Labstack Echo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118653: Echo Go web framework rate-limit bypass via spoofed IP headers

Q: Is there a fix for CVE-2026-118653?

Yes. github.com/labstack/echo/v5 (Go): upgrade to 5.1.0 or later. Until then: Explicitly configure Echo.IPExtractor with proper trust options when you need to read IP addresses from proxy headers; v4 users can restore the vulnerable behavior only intentionally by setting e.IPExtractor = echo.LegacyIPExtractor(), or upgrade to v5.1.0 where safe defaults are enforced. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-118653 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-118653?

Check whether you run github.com/labstack/echo/v4 (Go), github.com/labstack/echo/v5 (Go) or Labstack Echo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118653 · Severity: medium · CVSS 5.3 · Published 2026-10-28

Echo is a popular Go web framework used to build HTTP services. When the IPExtractor feature is not explicitly configured, the framework's rate limiter trusts client-supplied forwarding headers (X-Forwarded-For, X-Real-IP) to identify clients. An attacker can bypass IP-based rate limits by rotating arbitrary values in these headers to obtain new rate-limit buckets, potentially enabling brute-force attacks, credential stuffing, or request-flooding that protections rely on rate-limiting to prevent.

Technologies: github.com/labstack/echo/v4 (Go), github.com/labstack/echo/v5 (Go), Labstack Echo. Vendors: Go, Labstack.

Quick answers

Is CVE-2026-118653 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118653 being exploited in the wild.
How severe is CVE-2026-118653?: Medium severity, with a CVSS score of 5.3, published 28 October 2026.
Which products and versions are affected?: github.com/labstack/echo/v4 (Go) >= 4.0.0, <= 4.16.2, SEMVER:introduced=4.0.0, SEMVER:introduced=4.0.0,last_affected=4.16.2; github.com/labstack/echo/v5 (Go) < 5.1.0, SEMVER:introduced=0,fixed=5.1.0; Labstack Echo 4.0.0 through 5.0.x.
Is there a fix for CVE-2026-118653?: Yes. github.com/labstack/echo/v5 (Go): upgrade to 5.1.0 or later. Until then: Explicitly configure Echo.IPExtractor with proper trust options when you need to read IP addresses from proxy headers; v4 users can restore the vulnerable behavior only intentionally by setting e.IPExtractor = echo.LegacyIPExtractor(), or upgrade to v5.1.0 where safe defaults are enforced. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118653 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-118653?: Check whether you run github.com/labstack/echo/v4 (Go), github.com/labstack/echo/v5 (Go) or Labstack Echo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/labstack/echo/v5 (Go): upgrade to 5.1.0 or later
```
go get github.com/labstack/echo/v5@v5.1.0
```

Explicitly configure Echo.IPExtractor with proper trust options when you need to read IP addresses from proxy headers; v4 users can restore the vulnerable behavior only intentionally by setting e.IPExtractor = echo.LegacyIPExtractor(), or upgrade to v5.1.0 where safe defaults are enforced.

Technical details

Context.RealIP in Echo versions 4.0.0 through 5.0.x defaults to trusting client-supplied X-Forwarded-For and X-Real-IP headers when Echo.IPExtractor is not configured, allowing an attacker to spoof their source IP. The default RateLimiter uses this unsanitized IP value as its client identifier, permitting an attacker to bypass per-IP throttling by rotating header values across requests. The fix in v5.1.0 changes the default behavior to use only request.RemoteAddr unless IPExtractor is explicitly configured with proper trust options.

Affected products

labstack Echo 4.0.0 through 5.0.x

Identifiers

CVE-2026-118653
GHSA-246p-cpwv-v3jq
GO-2026-6872

Timeline

2026-10-28: disclosed
2026-03-31: patched: v5.1.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.