CVE-2026-118265

    Dashboard / Vulnerabilities / CVE-2026-118265

    CVE-2026-118265

    Published: 28 Oct 2026Last Modified: 5 Nov 2026

    Summary: Echo: X-Real-IP extractor trusts the header value instead of the sending peer

    Details: Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractIPFromRealIPHeader validates whether the client-supplied X-Real-IP value belongs to a trusted range instead of validating the direct network peer. A client reaching Echo directly, or through a proxy that preserves the header, can supply a loopback or private address and have Context.RealIP return that spoofed identity. Applications using the extractor for IP allowlists, rate limiting, audit logs, or forwarding headers can consequently trust an attacker-controlled address; the default direct extractor and Echo v4 are unaffected. This issue is fixed in 5.4.1.

    References: https://github.com/labstack/echo/releases/tag/v5.4.1, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118265.json, https://github.com/labstack/echo/security/advisories/GHSA-h53f-rm2w-w7rg, https://nvd.nist.gov/vuln/detail/CVE-2026-118265, https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaae

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 9500f2745481e2dff1313e2e6734c488e80c13fb
    Fixed -a6a9673a54d2c719ceb32ce6a929d35483acfb2b

    Affected versions

    v5.4.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-118265 | CVE-DB