UBUNTU-CVE-2026-118265: Medium severity ubuntu/golang-github-labstack-echo.v2 vulnerability
Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractIPFromRealIPHeader validates whether the client-supplied X-Real-IP value belongs to a trusted range instead of validating the direct network peer. A client reaching Echo directly, or through a proxy that preserves the header, can supply a loopback or private address and have Context.RealIP return that spoofed identity. Applications using the extractor for IP allowlists, rate limiting, audit logs, or forwarding headers can consequently trust an attacker-controlled address; the default direct extractor and Echo v4 are unaffected. This issue is fixed in 5.4.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Echo v5to a version that resolves this vulnerability.Fixed in 5.4.1
Frequently Asked Questions
Which deployments are exposed to spoofed client IP addresses?
Echo v5 deployments from 5.0.0 through 5.4.1 are exposed when they use ExtractIPFromRealIPHeader. A client can exploit this when it reaches Echo directly or when an intermediary proxy preserves the client-supplied X-Real-IP header.
What application functionality can be affected by exploitation?
Any application that relies on Context.RealIP with this extractor for IP allowlists, rate limiting, audit logging, or forwarding headers may treat an attacker-controlled loopback or private address as the client identity. The issue affects integrity of the reported address, not confidentiality or availability.
Are default Echo configurations or Echo v4 affected?
No. The default direct extractor is unaffected, and Echo v4 is also unaffected.
What is the available remediation?
Upgrade Echo v5 to version 5.4.1, which fixes the issue. If upgrading cannot happen immediately, avoid using ExtractIPFromRealIPHeader where untrusted clients can supply or preserve X-Real-IP.