CVE-2026-118653
Description
A flaw was found in Echo. When an IP address extractor is not explicitly configured, the framework trusts client-supplied forwarded HTTP headers to determine the client's network address. A remote attacker can exploit this flaw by sending requests with rotating or spoofed IP header values. This allows the attacker to bypass IP-based rate limiting and request throttling, potentially enabling unconstrained brute-force and credential stuffing attacks against protected endpoints.
Statement
This vulnerability is rated as Moderate because remote unauthenticated attackers can circumvent IP-based request throttling by supplying arbitrary forwarded headers, but it does not directly compromise data confidentiality, system integrity, or cause service disruption. In typical deployments where Echo-based services implement rate limiting without explicitly configuring a trusted IP extraction strategy, default behavior allows forged client address headers to allocate fresh rate-limit quotas. The blast radius is confined to secondary controls such as brute-force or volume throttling protections, requiring additional application-layer flaws to achieve deeper impact.
Understanding the Weakness (CWE)
Confidentiality,Access Control,Availability
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity; Varies by Context
When security decisions such as authentication and authorization are made based on the values of these inputs, attackers can bypass the security of the product to access whatever is being protected. An attacker could change these inputs using customized clients or other attacks. This change might not be detected. The consequences will depend on the associated functionality, but they can range from granting additional privileges to untrusted users to bypassing important security checks. Ultimately, this weakness may lead to exposure or modification of sensitive data, system crash, or execution of arbitrary code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
