{"id":"GO-2026-6841","revision":"e8adb4565e63476bb10eea80ae1d56f5","records":[{"revision":"e8adb4565e63476bb10eea80ae1d56f5","observedAt":"2026-11-05T23:38:32.248+00:00","statement":{"source":"osv","id":"GO-2026-6841","aliases":["CVE-2026-118265","GHSA-h53f-rm2w-w7rg"],"title":"Echo: X-Real-IP extractor trusts the header value instead of the sending peer in github.com/labstack/echo","description":"Echo: X-Real-IP extractor trusts the header value instead of the sending peer in github.com/labstack/echo","state":0,"publishedAt":"2026-11-05T22:54:11+00:00","modifiedAt":"2026-11-05T23:25:48.5227228+00:00","affected":[{"ecosystem":"Go","name":"github.com/labstack/echo/v5","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"5.0.0"},{"kind":"fixed","version":"5.4.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/labstack/echo/security/advisories/GHSA-h53f-rm2w-w7rg","https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec","https://github.com/labstack/echo/releases/tag/v5.4.1"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6841","license":"OSV · upstream source license applies","key":"osv:GO-2026-6841","identifiers":["GO-2026-6841","CVE-2026-118265","GHSA-h53f-rm2w-w7rg"]},"retained":false,"historicalAffected":[]}],"coverage":[]}