---
id: CVE-2026-118265
title: 'Echo: X-Real-IP extractor trusts the header value instead of the sending peer'
summary: >-
  Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's
  ExtractIPFromRealIPHeader validates whether the client-supplied X-Real-IP
  value belongs to a trusted range instead of validating the direct network
  peer. A client reaching Ech…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-348
vendor: labstack
product: echo
affected:
  - 'echo >= 5.0.0, < 5.4.1'
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-29T15:43:31.934498Z'
published: '2026-10-28'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T20:54:10.718Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118265'
references:
  - url: 'https://github.com/labstack/echo/security/advisories/GHSA-h53f-rm2w-w7rg'
    label: 'https://github.com/labstack/echo/security/advisories/GHSA-h53f-rm2w-w7rg'
  - url: >-
      https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaae
    label: >-
      https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaae
  - url: 'https://github.com/labstack/echo/releases/tag/v5.4.1'
    label: 'https://github.com/labstack/echo/releases/tag/v5.4.1'
  - url: >-
      https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec
  - url: 'https://github.com/labstack/echo'
  - url: 'https://github.com/advisories/GHSA-h53f-rm2w-w7rg'
tags:
  - cve.org
  - osv
  - go
  - ghsa
epss: 0.00139
epssPercentile: 0.03221
aliases:
  - GHSA-h53f-rm2w-w7rg
ecosystem: go
patched:
  - github.com/labstack/echo/v5 5.4.1
ingestedAt: '2026-10-28T19:16:53.299Z'
---

## Overview

Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractIPFromRealIPHeader validates whether the client-supplied X-Real-IP value belongs to a trusted range instead of validating the direct network peer. A client reaching Echo directly, or through a proxy that preserves the header, can supply a loopback or private address and have Context.RealIP return that spoofed identity. Applications using the extractor for IP allowlists, rate limiting, audit logs, or forwarding headers can consequently trust an attacker-controlled address; the default direct extractor and Echo v4 are unaffected. This issue is fixed in 5.4.1.

## Affected

- `echo >= 5.0.0, < 5.4.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-118265)

Affected packages:

- `github.com/labstack/echo/v5 >= 5.0.0, < 5.4.1`

Patched in:

- `github.com/labstack/echo/v5 5.4.1`

Source: https://osv.dev/vulnerability/GHSA-h53f-rm2w-w7rg