Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
Echo 5 allows spoofed client IP via X-Real-IP
published 7 days ago
Summary
The Echo web framework versions 5.0.0 through 5.4.0 trust the X-Real-IP header without checking the actual source of the request. An attacker can send a false IP address, causing the system to record or act on the wrong client identity, which can affect allowlists, rate limits, audit logs, and forwarded traffic. Upgrade to Echo version 5.4.1 or later, or configure the server to ignore the X-Real-IP header unless it comes from a trusted proxy.
What to do
- Update labstack github.com/labstack/echo/v5 to version 5.4.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Go | labstack | github.com/labstack/echo/v5 |
>= 5.0.0, < 5.4.1 Fix: upgrade to 5.4.1
|
Original advisory text
Echo: X-Real-IP extractor trusts the header value instead of the sending peer
Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractIPFromRealIPHeader validates whether the client-supplied X-Real-IP value belongs to a trusted range instead of validating the direct network peer. A client reaching Echo directly, or through a proxy that preserves the header, can supply a loopback or private address and have Context.RealIP return that spoofed identity. Applications using the extractor for IP allowlists, rate limiting, audit logs, or forwarding headers can consequently trust an attacker-controlled address; the default direct extractor and Echo v4 are unaffected. This issue is fixed in 5.4.1.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-348Use of Less Trusted Source
Timeline
Published28 Oct 2026
Updated28 Oct 2026
First seen23 Oct 2026
Sources
GHSA-h53f-rm2w-w7rg · OSV
Track software like this
Free during beta