Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🐹
🐹 Go
Not in CISA KEV
MEDIUM severity

Echo: X-Real-IP extractor trusts the header value instead of the sending peerGHSA-h53f-rm2w-w7rg

MEDIUMFix: labstack/echo@1855061

GHSA-h53f-rm2w-w7rg is a medium-severity (CVSS 5.3) vulnerability in github.com/labstack/echo/v5. A fix is available for github.com/labstack/echo/v5 — see the affected versions and patch details below.

Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Oct 23, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected
🐹github.com/labstack/echo/v5

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

Impact

In Echo v5, ExtractIPFromRealIPHeader checked whether the address supplied in X-Real-IP belonged to a trusted range instead of checking the address of the direct network peer. An untrusted client could therefore supply a loopback or private address and have it returned by c.RealIP() with the extractor's default trust options.

Applications using this extractor for IP allowlists, IP-based rate limiting, audit logs or forwarding headers could accept a spoofed client identity. Exploitation requires that the attacker can reach Echo directly or that an intervening proxy passes through the attacker's X-Real-IP value. Applications using the default direct IP extractor are unaffected. Echo v4 is unaffected by this v5 regression.

Affected versions and patch

All v5 releases from v5.0.0 through v5.4.0 are affected. Upgrade to v5.4.1.

The patch validates the direct peer before accepting a syntactically valid X-Real-IP value, restoring the v4 trust model. Fix commit.

Workarounds

Use ExtractIPDirect until upgrading, or ensure that only trusted proxies can reach Echo and that they replace client-supplied forwarding headers. Configure trusted proxy ranges narrowly for the deployment.

Credits

Reported and patched by @rm-Umar. @Duodum independently reported the same issue in GHSA-c3r7-8j36-7mx8, which is tracked as a duplicate of this advisory.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐹Gogithub.com/labstack/echo/v5≥ 5.0.0&&< 5.4.15.4.1go get github.com/labstack/echo/v5@v5.4.1

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/labstack/echo/v5, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update github.com/labstack/echo/v5 to 5.4.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-h53f-rm2w-w7rg is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

## Impact In Echo v5, `ExtractIPFromRealIPHeader` checked whether the address supplied in `X-Real-IP` belonged to a trusted range instead of checking the address of the direct network peer. An untrusted client could therefore supply a loopback or private address and have it returned by `c.RealIP()` with the extractor's default trust options. Applications using this extractor for IP allowlists, IP-based rate limiting, audit logs or forwarding headers could accept a spoofed client identity. Exploitation requires that the attacker can reach Echo directly or that an intervening proxy passes thro
O3 Security · Impact-Aware SCA

Is GHSA-h53f-rm2w-w7rg in your dependencies?

Find it across Go, including transitive dependencies.

Scan my dependencies How O3 SCA works
Echo: X-Real-IP extractor trusts the header value instead…