Echo: X-Real-IP Extractor Trusts The Header Value Instead Of The Sending Peer

Impact In Echo v5, "ExtractIPFromRealIPHeader" checked whether the address supplied in "X-Real-IP" belonged to a trusted range instead of checking the address of the direct network peer. An untrusted client could therefore supply a loopback or private address and have it returned by "c.RealIP" wi...

Linux Distros Unpatched Vulnerability : CVE-2026-118265

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractIPFromRealIPHeader validates whether the client-supplied X-Real-IP value belongs to a trust...

Use of Less Trusted Source

Overview github.com/labstack/echo/v5/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Use of Less Trusted Source via the ExtractIPFromRealIPHeader function in ip.go. With the extractor’s default trust options, an attacker can make c.RealIP return a...

Use of Less Trusted Source

Overview Affected versions of this package are vulnerable to Use of Less Trusted Source via the ExtractIPFromRealIPHeader function in ip.go. With the extractor’s default trust options, an attacker can make c.RealIP return a forged loopback or private address by sending an X-Real-IP header, causin...

CVE-2026-118265

Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractIPFromRealIPHeader validates whether the client-supplied X-Real-IP value belongs to a trusted range instead of validating the direct network peer. A client reaching Echo directly, or through a proxy that preserves the header, ca...

CVE-2026-118265

Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractIPFromRealIPHeader validates whether the client-supplied X-Real-IP value belongs to a trusted range instead of validating the direct network peer. A client reaching Echo directly, or through a proxy that preserves the header, ca...

UBUNTU-CVE-2026-118265

Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractIPFromRealIPHeader validates whether the client-supplied X-Real-IP value belongs to a trusted range instead of validating the direct network peer. A client reaching Echo directly, or through a proxy that preserves the header, ca...

EUVD-2026-112397

Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractIPFromRealIPHeader validates whether the client-supplied X-Real-IP value belongs to a trusted range instead of validating the direct network peer. A client reaching Echo directly, or through a proxy that preserves the header, ca...

CVE-2026-118265 Echo: X-Real-IP extractor trusts the header value instead of the sending peer

Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractIPFromRealIPHeader validates whether the client-supplied X-Real-IP value belongs to a trusted range instead of validating the direct network peer. A client reaching Echo directly, or through a proxy that preserves the header, ca...

CVE-2026-118265

The Echo Go web framework (versions v5.0.0 through v5.4.0 ) contains a vulnerability in the ExtractIPFromRealIPHeader component. The root cause is that the framework validates whether the X-Real-IP header value belongs to a trusted range rather than verifying the direct network peer. This allows ...

CVE-2026-118265 Echo: X-Real-IP extractor trusts the header value instead of the sending peer

Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractIPFromRealIPHeader validates whether the client-supplied X-Real-IP value belongs to a trusted range instead of validating the direct network peer. A client reaching Echo directly, or through a proxy that preserves the header, ca...

CVE-2026-118265

Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractIPFromRealIPHeader validates whether the client-supplied X-Real-IP value belongs to a trusted range instead of validating the direct network peer. A client reaching Echo directly, or through a proxy that preserves the header, ca...

CVE-2026-118265 Echo: X-Real-IP extractor trusts the header value instead of the sending peer

Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractIPFromRealIPHeader validates whether the client-supplied X-Real-IP value belongs to a trusted range instead of validating the direct network peer. A client reaching Echo directly, or through a proxy that preserves the header, ca...

LabStack Echo Trust Management issue vulnerability

In LabStack Echo versions 5.0.0 through 5.4.1, there is a trust management vulnerability. This vulnerability arises from ExtractIPFromRealIPHeader’s validation of whether the X-Real-IP value provided by the client falls within a trusted range; it does not directly verify the network endpoint...

CVE-2026-118265: Use of Less Trusted Source

Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractIPFromRealIPHeader validates whether the client-supplied X-Real-IP value belongs to a trusted range instead of validating the direct network peer. A client reaching Echo directly, or through a proxy that preserves the header, ca...

Echo: X-Real-IP extractor trusts the header value instead of the sending peer

Impact In Echo v5, ExtractIPFromRealIPHeader checked whether the address supplied in X-Real-IP belonged to a trusted range instead of checking the address of the direct network peer. An untrusted client could therefore supply a loopback or private address and have it returned by c.RealIP with the...

GHSA-H53F-RM2W-W7RG Echo: X-Real-IP extractor trusts the header value instead of the sending peer

Impact In Echo v5, ExtractIPFromRealIPHeader checked whether the address supplied in X-Real-IP belonged to a trusted range instead of checking the address of the direct network peer. An untrusted client could therefore supply a loopback or private address and have it returned by c.RealIP with the...

PT-2026-129135

Name of the Vulnerable Software and Affected Versions Echo versions 5.0.0 through 5.4.0 Description In the Go web framework Echo, the ExtractIPFromRealIPHeader function validates whether the client-supplied X-Real-IP value belongs to a trusted range instead of validating the direct network peer...