{"id":"EUVD-2026-112406","enisaUuid":"3536cf66-ba95-3045-a804-77addaad9b19","description":"Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address, undermining IP-based access controls, rate limiting, audit logging, or geographic restrictions that trust Echo\u0027s forwarded identity. This issue is fixed in Echo 5.4.0.","datePublished":"Oct 28, 2026, 7:30:01 PM","dateUpdated":"Oct 28, 2026, 7:31:47 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","references":"https://github.com/labstack/echo/security/advisories/GHSA-99jh-6h7p-pp36\nhttps://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af\nhttps://github.com/labstack/echo/releases/tag/v5.4.0\n","aliases":"CVE-2026-118651\n","assigner":"GitHub_M","epss":0.0,"enisaIdProduct":[{"id":"25b3f16f-7658-3e3f-af23-fefe5222c551","product":{"name":"Echo","vendor":{"name":"Wikimedia Foundation"}},"product_version":"4.0.0, \u003c 5.4.0"}],"enisaIdVendor":[{"id":"5e169a07-e28a-3434-88b4-65ddb7ce05a6","vendor":{"name":"labstack"}}],"enisaIdVulnerability":[{"id":"cc4ee322-f1dc-385c-9db3-4dd5539cd939","vulnerability":{"id":"CVE-2026-118651","description":"Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address, undermining IP-based access controls, rate limiting, audit logging, or geographic restrictions that trust Echo\u0027s forwarded identity. This issue is fixed in Echo 5.4.0.","datePublished":"Oct 28, 2026, 7:30:01 PM","dateUpdated":"Oct 28, 2026, 7:31:47 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","references":"https://github.com/labstack/echo/security/advisories/GHSA-99jh-6h7p-pp36\nhttps://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af\nhttps://github.com/labstack/echo/releases/tag/v5.4.0\n","enisa_id":"EUVD-2026-112406\n","assigner":"GitHub_M","epss":0.0,"dataProcessed":"Oct 28, 2026, 10:00:11 PM","vulnerabilityProduct":[{"id":"804c911b-9525-3451-8615-2196adc034d5","product":{"name":"Echo","vendor":{"name":"Wikimedia Foundation"}},"product_version":"4.0.0, \u003c 5.4.0"}],"vulnerabilityVendor":[{"id":"dbbeaa76-fb50-3be9-bc13-25a33587309c","vendor":{"name":"labstack"}}]}}],"enisaIdAdvisory":[]}