Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration

Summary When echo.New is used without explicitly setting EchoIPExtractor, the RealIP method falls back to reading the client-supplied X-Forwarded-For or X-Real-IP header without any proxy-origin validation. The default RateLimiter middleware derives its per-client identifier from ctx.RealIP, so a...

EUVD-2026-112409

Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-Forwarded-For or X-Real-IP values when Echo.IPExtractor is unset, and the default RateLimiter uses that result as its client identifier. A remote attacker can rotate arbitrary forwarded-address valu...

CVE-2026-118653 Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration

Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-Forwarded-For or X-Real-IP values when Echo.IPExtractor is unset, and the default RateLimiter uses that result as its client identifier. A remote attacker can rotate arbitrary forwarded-address valu...

PT-2026-129169

Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-Forwarded-For or X-Real-IP values when Echo.IPExtractor is unset, and the default RateLimiter uses that result as its client identifier. A remote attacker can rotate arbitrary forwarded-address valu...

CVE-2026-55795: Improper Restriction of Excessive Authentication Attempts

Craft Commerce is an ecommerce platform for Craft CMS. From 4.0.0 until 4.11.2 and 5.6.5, CartController in src/controllers/CartController.php activates its RateLimiter only when the number POST or GET parameter is supplied. An unauthenticated attacker can submit couponCode values to...

EUVD-2025-111357

Malicious code in materialize-winston-rate-limiter-webdriver-mocha npm...

Nextcloud: Memcached used as RateLimiter backend is no-op

A vulnerability was discovered where the Memcached cache was used as the backend for rate limiting. This resulted in cache entries being wiped and rate limit attempts and bruteforce protection being bypassed...

systemd security and bug fix update

219-78.0.1 - Backport upstream patches related to private-tmp Sushmita Bhattacharya Orabug: 31561883 - backport upstream pstore tmpfiles patch Eric DeVolder Orabug: 31414539 - udev rules: fix memory hot add and remove Orabug: 31309730 - enable and start the pstore service Orabug: 30950903 - fix t...