GHSA-h53f-rm2w-w7rg

Source

https://github.com/advisories/GHSA-h53f-rm2w-w7rg

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-h53f-rm2w-w7rg/GHSA-h53f-rm2w-w7rg.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-h53f-rm2w-w7rg

Published

2026-10-23T20:50:25Z

Modified

2026-10-23T21:00:04Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

Echo: X-Real-IP extractor trusts the header value instead of the sending peer

Details

Impact

In Echo v5, ExtractIPFromRealIPHeader checked whether the address supplied in X-Real-IP belonged to a trusted range instead of checking the address of the direct network peer. An untrusted client could therefore supply a loopback or private address and have it returned by c.RealIP() with the extractor's default trust options.

Applications using this extractor for IP allowlists, IP-based rate limiting, audit logs or forwarding headers could accept a spoofed client identity. Exploitation requires that the attacker can reach Echo directly or that an intervening proxy passes through the attacker's X-Real-IP value. Applications using the default direct IP extractor are unaffected. Echo v4 is unaffected by this v5 regression.

Affected versions and patch

All v5 releases from v5.0.0 through v5.4.0 are affected. Upgrade to v5.4.1.

The patch validates the direct peer before accepting a syntactically valid X-Real-IP value, restoring the v4 trust model. Fix commit.

Workarounds

Use ExtractIPDirect until upgrading, or ensure that only trusted proxies can reach Echo and that they replace client-supplied forwarding headers. Configure trusted proxy ranges narrowly for the deployment.

Credits

Reported and patched by @rm-Umar. @Duodum independently reported the same issue in GHSA-c3r7-8j36-7mx8, which is tracked as a duplicate of this advisory.

Database specific

{
    "cwe_ids":  [
        "CWE-348"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-10-23T20:50:25Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

Go / github.com/labstack/echo/v5

Package

Name: github.com/labstack/echo/v5; View open source insights on deps.dev
Purl: pkg:golang/github.com/labstack/echo/v5

Affected ranges

Type: SEMVER
Events: Introduced

5.0.0

Fixed

5.4.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-h53f-rm2w-w7rg/GHSA-h53f-rm2w-w7rg.json"