{"id":"GO-2026-6875","revision":"1c59d4fddf37411db7f76f8d9f77e2c7","records":[{"revision":"1c59d4fddf37411db7f76f8d9f77e2c7","observedAt":"2026-11-05T23:38:32.248+00:00","statement":{"source":"osv","id":"GO-2026-6875","aliases":["CVE-2026-118651","GHSA-99jh-6h7p-pp36"],"title":"Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo","description":"Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo","state":0,"publishedAt":"2026-11-05T22:54:32+00:00","modifiedAt":"2026-11-05T23:15:15.5635945+00:00","affected":[{"ecosystem":"Go","name":"github.com/labstack/echo/v4","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"4.0.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/labstack/echo/v5","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"5.4.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/labstack/echo/security/advisories/GHSA-99jh-6h7p-pp36","https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af","https://github.com/labstack/echo/releases/tag/v5.4.0"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6875","license":"OSV · upstream source license applies","key":"osv:GO-2026-6875","identifiers":["GO-2026-6875","CVE-2026-118651","GHSA-99jh-6h7p-pp36"]},"retained":false,"historicalAffected":[]}],"coverage":[]}