{"schema":"threatline.record/2","record":{"id":"CVE-2026-118265","aliases":["GHSA-h53f-rm2w-w7rg"],"summary":"Echo: X-Real-IP extractor trusts the header value instead of the sending peer","details":"## Impact\n\nIn Echo v5, `ExtractIPFromRealIPHeader` checked whether the address supplied in `X-Real-IP` belonged to a trusted range instead of checking the address of the direct network peer. An untrusted client could therefore supply a loopback or private address and have it returned by `c.RealIP()` with the extractor's default trust options.\n\nApplications using this extractor for IP allowlists, IP-based rate limiting, audit logs or forwarding headers could accept a spoofed client identity. Exploitation requires that the attacker can reach Echo directly or that an intervening proxy passes through the attacker's `X-Real-IP` value. Applications using the default direct IP extractor are unaffected. Echo v4 is unaffected by this v5 regression.\n\n## Affected versions and patch\n\nAll v5 releases from v5.0.0 through v5.4.0 are affected. Upgrade to [v5.4.1](https://github.com/labstack/echo/releases/tag/v5.4.1).\n\nThe patch validates the direct peer before accepting a syntactically valid `X-Real-IP` value, restoring the v4 trust model. [Fix commit](https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec).\n\n## Workarounds\n\nUse `ExtractIPDirect` until upgrading, or ensure that only trusted proxies can reach Echo and that they replace client-supplied forwarding headers. Configure trusted proxy ranges narrowly for the deployment.\n\n## Credits\n\nReported and patched by @rm-Umar. @Duodum independently reported the same issue in GHSA-c3r7-8j36-7mx8, which is tracked as a duplicate of this advisory.","categories":["Libraries & packages"],"product":"github.com/labstack/echo/v5","vendor":"labstack","ecosystem":"go","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-h53f-rm2w-w7rg","source_modified_at":"2026-10-28T19:04:05Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"ecosystem":"go","name":"github.com/labstack/echo/v5"},"range":">= 5.0.0, < 5.4.1"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-118265","source_modified_at":"2026-10-28T19:03:56.934Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":"echo","vendor":"labstack","versions":[{"version":">= 5.0.0, < 5.4.1","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-h53f-rm2w-w7rg","source_modified_at":"2026-10-28T19:15:03.307613547Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"github.com/labstack/echo/v5","ecosystem":"Go","purl":"pkg:golang/github.com/labstack/echo/v5"},"ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0"},{"fixed":"5.4.1"}]}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-h53f-rm2w-w7rg","source_modified_at":"2026-10-28T19:04:05Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"ecosystem":"go","name":"github.com/labstack/echo/v5"},"version":"5.4.1"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-h53f-rm2w-w7rg","source_modified_at":"2026-10-28T19:15:03.307613547Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"github.com/labstack/echo/v5","ecosystem":"Go","purl":"pkg:golang/github.com/labstack/echo/v5"},"version":"5.4.1"}],"cvss":5.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T19:03:56.934Z","modified_at":"2026-10-28T19:15:03.307613547Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-h53f-rm2w-w7rg","fetched_at":"2026-10-28T20:58:01.013507Z","source_modified_at":"2026-10-28T19:04:05Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-118265","fetched_at":"2026-10-28T20:58:01.013507Z","source_modified_at":"2026-10-28T19:03:56.934Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-h53f-rm2w-w7rg","fetched_at":"2026-10-28T20:58:01.013507Z","source_modified_at":"2026-10-28T19:15:03.307613547Z"}],"sources":["GitHub Advisory Database","CVE List","OSV"],"references":[{"source":"CVE List","url":"https://github.com/labstack/echo/security/advisories/GHSA-h53f-rm2w-w7rg","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/labstack/echo/releases/tag/v5.4.1","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-h53f-rm2w-w7rg","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaae","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-28T19:15:03.307613547Z","content_hash":"8adde5373b898cfad09842cf2b7fd6e1260451e42639dbe579b9a45d9d000a29"}}