{"id":"CVE-2026-118265","aliases":["GHSA-h53f-rm2w-w7rg"],"url":"https://o3.security/vulnerability/CVE-2026-118265","summary":"Echo: X-Real-IP extractor trusts the header value instead of the sending peer","details":"## Impact\n\nIn Echo v5, `ExtractIPFromRealIPHeader` checked whether the address supplied in `X-Real-IP` belonged to a trusted range instead of checking the address of the direct network peer. An untrusted client could therefore supply a loopback or private address and have it returned by `c.RealIP()` with the extractor's default trust options.\n\nApplications using this extractor for IP allowlists, IP-based rate limiting, audit logs or forwarding headers could accept a spoofed client identity. Exploitation requires that the attacker can reach Echo directly or that an intervening proxy passes through the attacker's `X-Real-IP` value. Applications using the default direct IP extractor are unaffected. Echo v4 is unaffected by this v5 regression.\n\n## Affected versions and patch\n\nAll v5 releases from v5.0.0 through v5.4.0 are affected. Upgrade to [v5.4.1](https://github.com/labstack/echo/releases/tag/v5.4.1).\n\nThe patch validates the direct peer before accepting a syntactically valid `X-Real-IP` value, restoring the v4 trust model. [Fix commit](https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec).\n\n## Workarounds\n\nUse `ExtractIPDirect` until upgrading, or ensure that only trusted proxies can reach Echo and that they replace client-supplied forwarding headers. Configure trusted proxy ranges narrowly for the deployment.\n\n## Credits\n\nReported and patched by @rm-Umar. @Duodum independently reported the same issue in GHSA-c3r7-8j36-7mx8, which is tracked as a duplicate of this advisory.","published":"2026-10-28T19:03:56.934Z","modified":"2026-10-29T10:45:57.739173273Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Go","name":"github.com/labstack/echo/v5","fixedVersion":"5.4.1"}],"fix":{"url":"https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaae","label":"labstack/echo@1855061"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118265.json"},{"type":"FIX","url":"https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaae"},{"type":"WEB","url":"https://github.com/labstack/echo/releases/tag/v5.4.1"},{"type":"ADVISORY","url":"https://github.com/labstack/echo/security/advisories/GHSA-h53f-rm2w-w7rg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118265"},{"type":"WEB","url":"https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec"},{"type":"PACKAGE","url":"https://github.com/labstack/echo"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-29T10:45:57.739173273Z"}}