{"id":"GO-2026-6841","summary":"Echo: X-Real-IP extractor trusts the header value instead of the sending peer in github.com/labstack/echo","details":"Echo: X-Real-IP extractor trusts the header value instead of the sending peer in github.com/labstack/echo","aliases":["CVE-2026-118265","GHSA-h53f-rm2w-w7rg"],"modified":"2026-11-05T23:25:48.522722786Z","published":"2026-11-05T22:54:11Z","database_specific":{"url":"https://pkg.go.dev/vuln/GO-2026-6841","review_status":"REVIEWED"},"references":[{"type":"ADVISORY","url":"https://github.com/labstack/echo/security/advisories/GHSA-h53f-rm2w-w7rg"},{"type":"FIX","url":"https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec"},{"type":"WEB","url":"https://github.com/labstack/echo/releases/tag/v5.4.1"}],"affected":[{"package":{"name":"github.com/labstack/echo/v5","ecosystem":"Go","purl":"pkg:golang/github.com/labstack/echo/v5"},"ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0"},{"fixed":"5.4.1"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/labstack/echo/v5/middleware","symbols":["AddTrailingSlash","AddTrailingSlashWithConfig","BasicAuth","BasicAuthWithConfig","BodyDump","BodyDumpConfig.ToMiddleware","BodyDumpWithConfig","BodyLimit","BodyLimitWithConfig","CORS","CORSConfig.ToMiddleware","CORSWithConfig","CSRF","CSRFConfig.ToMiddleware","CSRFWithConfig","ContextTimeout","ContextTimeoutWithConfig","CreateExtractors","Decompress","DecompressWithConfig","Gzip","GzipWithConfig","HTTPSNonWWWRedirect","HTTPSNonWWWRedirectWithConfig","HTTPSRedirect","HTTPSRedirectWithConfig","HTTPSWWWRedirect","HTTPSWWWRedirectWithConfig","KeyAuth","KeyAuthConfig.ToMiddleware","KeyAuthWithConfig","MethodOverride","MethodOverrideWithConfig","NonWWWRedirect","NonWWWRedirectWithConfig","PanicStackError.Error","Proxy","ProxyConfig.ToMiddleware","ProxyWithConfig","RateLimiter","RateLimiterMemoryStore.AllowContext","RateLimiterWithConfig","Recover","RecoverWithConfig","RemoveTrailingSlash","RemoveTrailingSlashWithConfig","RequestID","RequestIDWithConfig","RequestLogger","RequestLoggerConfig.ToMiddleware","RequestLoggerWithConfig","Rewrite","RewriteConfig.ToMiddleware","RewriteWithConfig","Secure","SecureConfig.ToMiddleware","SecureWithConfig","Static","StaticConfig.ToMiddleware","StaticWithConfig","WWWRedirect","WWWRedirectWithConfig","bodyDumpResponseWriter.Flush","bodyDumpResponseWriter.Hijack","bodyDumpResponseWriter.Write","bodyDumpResponseWriter.WriteHeader","gzipResponseWriter.Flush","gzipResponseWriter.Hijack","gzipResponseWriter.Write","gzipResponseWriter.WriteHeader","limitedGzipReader.Read","limitedReader.Close","limitedReader.Read","limitedWriter.Write","proxyHTTP","proxyRaw"]},{"symbols":["ExtractIPFromRealIPHeader"],"path":"github.com/labstack/echo/v5"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6841.json"}}],"schema_version":"1.9.2"}