Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-118265— Echo: X-Real-IP extractor trusts the header value instead of the sending peer

Quick assessment

Affected

labstack echo

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Echo 是一个基于 Go 的 Web 框架。在版本 5.0.0 至 5.4.1 期间，Echo v5 中的函数仅验证客户端提供的头字段值是否属于受信任的 IP 范围，而未对直接的网络对等端（即实际连接源）进行验证。因此，直接访问 Echo 实例、或通过保留该请求头的代理访问 Echo 的客户端，可以提交回环地址（loopback）或私有地址，导致返回被伪造的 IP 身份。若应用程序利用该提取器实现 IP 白名单、速率限制、审计日志或转发请求头等功能，则可能错误地信任由攻击者控制的 IP 地址。此问题不影响默

CVSS 5.3 · Medium Updated Oct 29, 2026

Possible ATT&CK Techniques 2 AI

T1190 · Exploit Public-Facing Application T1070.004 · File Deletion

Affected Version Matrix 1

Vendor	Product	Version Range	Status
labstack	echo	`>= 5.0.0, < 5.4.1`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Echo: X-Real-IP extractor trusts the header value instead of the sending peer

Source: CVE Program / CVE List V5

Vulnerability Description

Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractIPFromRealIPHeader validates whether the client-supplied X-Real-IP value belongs to a trusted range instead of validating the direct network peer. A client reaching Echo directly, or through a proxy that preserves the header, can supply a loopback or private address and have Context.RealIP return that spoofed identity. Applications using the extractor for IP allowlists, rate limiting, audit logs, or forwarding headers can consequently trust an attacker-controlled address; the default direct extractor and Echo v4 are unaffected. This issue is fixed in 5.4.1.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

使用不可信的源

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
labstack	echo	>= 5.0.0, < 5.4.1	-

II. Public POCs for CVE-2026-118265

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-118265

请登录查看更多情报信息。

Other References for CVE-2026-118265 (3)

https://github.com/labstack/echo/releases/tag/v5.4.1 x_refsource_MISC
https://github.com/labstack/echo/security/advisories/GHSA-h53f-rm2w-w7rg x_refsource_CONFIRM
https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaae x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-118265

Same Patch Batch · labstack · 2026-10-28 · 16 CVEs total

CVE-2026-118264	9.1 CRITICAL	Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls
CVE-2026-118260	8.2 HIGH	Echo: BodyDump captures request and response bodies without size limits in v4
CVE-2026-118262	8.2 HIGH	Echo: WebSocket proxy can retain connections and handlers after client disconnect
CVE-2026-118261	8.2 HIGH	Echo: Decompress permits unbounded gzip expansion in v4
CVE-2026-118650	7.5 HIGH	Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a sta
CVE-2026-118263	6.3 MEDIUM	Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests
CVE-2026-118652	6.1 MEDIUM	Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP
CVE-2026-118656	6.1 MEDIUM	Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI
CVE-2026-118654	5.9 MEDIUM	Echo static file middleware route protection bypass via encoded dot-dot traversal
CVE-2026-118655	5.9 MEDIUM	Echo: Static Middleware Double-Unescape Path Traversal
CVE-2026-118657	5.9 MEDIUM	Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers
CVE-2026-118651	5.3 MEDIUM	Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default
CVE-2026-118266	5.3 MEDIUM	Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method
CVE-2026-118653	5.3 MEDIUM	Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration
CVE-2026-118658	4.7 MEDIUM	Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded

IV. Related Vulnerabilities

Same product: echo

Same vendor: labstack

Same weakness: CWE-348