GO-2026-6841: Echo: X-Real-IP extractor trusts the header value instead of the sending peer in github.com/labstack/echo
Published Nov 5, 2026
·Updated
Echo: X-Real-IP extractor trusts the header value instead of the sending peer in github.com/labstack/echo
Affected Software
1 affected componentFixes available
go/github.com/labstack/echo/v5>=5.0.0<5.4.1
5.4.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/labstack/echo/v5to a version that resolves this vulnerability.Fixed in 5.4.1
Event History
Nov 5, 2026
Advisory Published
via OSV·10:54 PM
Data Sourced
via OSV·10:54 PM
DescriptionAffected Software
Frequently Asked Questions
1
Which dependency should be checked during inventory and impact assessment?
Check applications using the Go module github.com/labstack/echo/v5.
2
Which upstream release is referenced for this issue?
The provided references include the Echo v5.4.1 release.