DEBIAN-CVE-2026-118651: Medium severity debian/golang-github-labstack-echo vulnerability

Published Oct 28, 2026

Updated

Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address, undermining IP-based access controls, rate limiting, audit logging, or geographic restrictions that trust Echo's forwarded identity. This issue is fixed in Echo 5.4.0.

Affected Software

3 affected components

debian/golang-github-labstack-echo*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Echo to a version that resolves this vulnerability.
Fixed in 5.4.0

Event History

Oct 28, 2026

CVE Published

via OSV·08:17 PM

Data Sourced

via OSV·08:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are affected?

Deployments using Echo versions from 4.0.0 through 5.4.0 are affected when the Proxy middleware is used and Echo.IPExtractor is not configured.

What does an attacker need to exploit this issue?

A remote client can exploit the issue over the network without authentication, privileges, or user interaction by supplying an X-Real-IP header.

How can I determine whether my service is exposed?

Check whether the application uses Echo Proxy middleware, runs an affected Echo version, and does not configure Echo.IPExtractor. Upstream services are at risk if they trust the forwarded client address for controls such as allowlists, rate limits, logging, or geographic restrictions.

What should be done if the application is affected?

Upgrade to Echo 5.4.0, which fixes the issue. Review upstream services that rely on the forwarded client identity, because spoofed addresses may have affected their access-control decisions or audit records.

DEBIAN-CVE-2026-118651: Medium severity debian/golang-github-labstack-echo vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

How can I determine whether my service is exposed?

What should be done if the application is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

How can I determine whether my service is exposed?

What should be done if the application is affected?