{"id":"EUVD-2026-112397","enisaUuid":"815d6fea-fc69-311d-828a-3363878ccfdd","description":"Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5\u0027s ExtractIPFromRealIPHeader validates whether the client-supplied X-Real-IP value belongs to a trusted range instead of validating the direct network peer. A client reaching Echo directly, or through a proxy that preserves the header, can supply a loopback or private address and have Context.RealIP return that spoofed identity. Applications using the extractor for IP allowlists, rate limiting, audit logs, or forwarding headers can consequently trust an attacker-controlled address; the default direct extractor and Echo v4 are unaffected. This issue is fixed in 5.4.1.","datePublished":"Oct 28, 2026, 7:03:56 PM","dateUpdated":"Oct 29, 2026, 8:54:10 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","references":"https://github.com/labstack/echo/security/advisories/GHSA-h53f-rm2w-w7rg\nhttps://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaae\nhttps://github.com/labstack/echo/releases/tag/v5.4.1\n","aliases":"CVE-2026-118265\n","assigner":"GitHub_M","epss":0.14,"enisaIdProduct":[{"id":"b070cde9-7b23-3ffb-ab1a-884808922543","product":{"name":"Echo","vendor":{"name":"Wikimedia Foundation"}},"product_version":"5.0.0, \u003c 5.4.1"}],"enisaIdVendor":[{"id":"bae68b84-cd6e-3c94-91cb-b6ab96f0f192","vendor":{"name":"labstack"}}],"enisaIdVulnerability":[{"id":"a88cbe87-5c0a-3aaa-a252-f4aa1ebf79a0","vulnerability":{"id":"CVE-2026-118265","description":"Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5\u0027s ExtractIPFromRealIPHeader validates whether the client-supplied X-Real-IP value belongs to a trusted range instead of validating the direct network peer. A client reaching Echo directly, or through a proxy that preserves the header, can supply a loopback or private address and have Context.RealIP return that spoofed identity. Applications using the extractor for IP allowlists, rate limiting, audit logs, or forwarding headers can consequently trust an attacker-controlled address; the default direct extractor and Echo v4 are unaffected. This issue is fixed in 5.4.1.","datePublished":"Oct 28, 2026, 7:03:56 PM","dateUpdated":"Oct 29, 2026, 8:54:10 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","references":"https://github.com/labstack/echo/security/advisories/GHSA-h53f-rm2w-w7rg\nhttps://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaae\nhttps://github.com/labstack/echo/releases/tag/v5.4.1\n","enisa_id":"EUVD-2026-112397\n","assigner":"GitHub_M","epss":0.14,"dataProcessed":"Nov 5, 2026, 7:16:11 AM","vulnerabilityProduct":[{"id":"18864b93-6a5d-3f81-861c-28b311c638c8","product":{"name":"Echo","vendor":{"name":"Wikimedia Foundation"}},"product_version":"5.0.0, \u003c 5.4.1"}],"vulnerabilityVendor":[{"id":"14b6a4cf-2761-3028-a89f-cf7d56c7e1eb","vendor":{"name":"labstack"}}]}}],"enisaIdAdvisory":[]}