{"id":"GHSA-h53f-rm2w-w7rg","kind":"vulnerability","aliases":["GHSA-h53f-rm2w-w7rg"],"related":[],"title":"Echo: X-Real-IP extractor trusts the header value instead of the sending peer","description":"## Impact\n\nIn Echo v5, `ExtractIPFromRealIPHeader` checked whether the address supplied in `X-Real-IP` belonged to a trusted range instead of checking the address of the direct network peer. An untrusted client could therefore supply a loopback or private address and have it returned by `c.RealIP()` with the extractor's default trust options.\n\nApplications using this extractor for IP allowlists, IP-based rate limiting, audit logs or forwarding headers could accept a spoofed client identity. Exploitation requires that the attacker can reach Echo directly or that an intervening proxy passes through the attacker's `X-Real-IP` value. Applications using the default direct IP extractor are unaffected. Echo v4 is unaffected by this v5 regression.\n\n## Affected versions and patch\n\nAll v5 releases from v5.0.0 through v5.4.0 are affected. Upgrade to [v5.4.1](https://github.com/labstack/echo/releases/tag/v5.4.1).\n\nThe patch validates the direct peer before accepting a syntactically valid `X-Real-IP` value, restoring the v4 trust model. [Fix commit](https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec).\n\n## Workarounds\n\nUse `ExtractIPDirect` until upgrading, or ensure that only trusted proxies can reach Echo and that they replace client-supplied forwarding headers. Configure trusted proxy ranges narrowly for the deployment.\n\n## Credits\n\nReported and patched by @rm-Umar. @Duodum independently reported the same issue in GHSA-c3r7-8j36-7mx8, which is tracked as a duplicate of this advisory.","summary":"Echo v5's X-Real-IP extractor checks whether the header value is trusted instead of the direct TCP peer, so a client can send an arbitrary loopback or private IP. An attacker can then have c.RealIP() return that spoofed address and bypass IP allowlists, rate limits or audit logging that depend on it.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/labstack/echo/v5","fixed":["5.4.1"],"affected":">= 5.0.0, < 5.4.1","ecosystem":"go"}],"ecosystems":["go"],"tags":["cwe-348","echo","go","ip-allowlist","package","rate-limiting","v5"],"not_affected_if":["default-direct-ip-extractor","echo-v4","no-ip-based-access-control"],"how_to_check":"Check go.mod for github.com/labstack/echo/v5 at a version >= 5.0.0 and < 5.4.1.\nLook for usage of ExtractIPFromRealIPHeader in the Echo setup code.","fix":"Upgrade github.com/labstack/echo/v5 to v5.4.1 or later.\nUntil then, switch to ExtractIPDirect or ensure only trusted proxies can reach Echo and strip client-supplied X-Real-IP headers.","status":"open","published_at":"2026-10-23T20:50:25+00:00","first_seen_at":"2026-10-23T20:59:05+00:00","triaged_at":"2026-10-23T21:00:22+00:00","updated_at":"2026-10-23T21:00:22+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-23T21:00:22Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/labstack/echo/v5 to v5.4.1 or later.\nUntil then, switch to ExtractIPDirect or ensure only trusted proxies can reach Echo and strip client-supplied X-Real-IP headers.","reach":"internet","impact":"medium","summary":"Echo v5's X-Real-IP extractor checks whether the header value is trusted instead of the direct TCP peer, so a client can send an arbitrary loopback or private IP. An attacker can then have c.RealIP() return that spoofed address and bypass IP allowlists, rate limits or audit logging that depend on it.","category":"package","who_cares":["go","echo","v5","ip-allowlist","rate-limiting"],"confidence":0.85,"needs_auth":"no","worst_case":"Attacker spoofs client IP, bypassing IP allowlists and rate limits","analyst_note":"","how_to_check":"Check go.mod for github.com/labstack/echo/v5 at a version >= 5.0.0 and < 5.4.1.\nLook for usage of ExtractIPFromRealIPHeader in the Echo setup code.\nunknown","needs_analyst":false,"not_affected_if":["echo-v4","default-direct-ip-extractor","no-ip-based-access-control"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000574,"input_tokens":3325,"output_tokens":483,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-348':30B '/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec).':256C '/labstack/echo/releases/tag/v5.4.1).':230C '/labstack/echo/v5':28A '7mx8':307C '8j36':306C 'accept':166C,238C 'address':82B,102C,118C,134C 'advisori':316C 'affect':212C,224C 'allowlist':35B,86B,154C 'applic':148C,195C 'arbitrari':68B 'attack':74B,175C,188C 'audit':90B,160C 'base':157C 'belong':109C 'bypass':84B 'c.realip':78B,140C 'c3r7':305C 'check':49B,99C,116C 'client':64B,126C,169C,276C 'client-suppli':275C 'commit':253C 'configur':280C 'could':127C,165C 'credit':288C 'cwe':29B 'default':145C,198C 'depend':93B 'deploy':287C 'direct':59B,121C,179C,199C,235C 'duodum':296C 'duplic':313C 'echo':1A,31B,41B,96C,178C,204C,270C 'ensur':263C 'exploit':171C 'extractipdirect':259C 'extractipfromrealiphead':98C 'extractor':6A,48B,143C,151C,201C 'fix':252C 'forward':163C,278C 'ghsa':17A,22A,304C 'ghsa-c3r7-8j36-7mx8':303C 'ghsa-h53f-rm2w-w7rg':16A,21A 'github.com':27A,229C,255C 'github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec).':254C 'github.com/labstack/echo/releases/tag/v5.4.1).':228C 'github.com/labstack/echo/v5':26A 'go':32B 'h53f':18A,23A 'header':9A,52B,164C,279C 'ident':170C 'impact':94C 'independ':297C 'instead':11A,56B,114C 'interven':183C 'ip':5A,34B,47B,72B,85B,108C,153C,156C,193C,200C,245C 'ip-allowlist':33B 'ip-bas':155C 'issu':301C 'limit':39B,88B,159C 'log':91B,161C 'loopback':69B,131C 'model':251C 'narrowli':284C 'network':122C 'option':147C 'packag':36B 'pass':185C 'patch':215C,232C,291C 'peer':15A,61B,123C,236C 'privat':71B,133C 'proxi':184C,267C,282C 'rang':113C,283C 'rate':38B,87B,158C 'rate-limit':37B 'reach':177C,269C 'real':4A,46B,107C,192C,244C 'regress':211C 'releas':218C 'replac':274C 'report':289C,298C 'requir':172C 'restor':247C 'return':79B,138C 'rm':294C 'rm-umar':293C 'rm2w':19A,24A 'send':14A,66B 'spoof':81B,168C 'suppli':103C,129C,277C 'syntact':240C 'tcp':60B 'therefor':128C 'track':310C 'trust':7A,55B,112C,146C,250C,266C,281C 'umar':295C 'unaffect':203C,207C 'untrust':125C 'upgrad':225C,261C 'use':149C,196C,258C 'v4':205C,249C 'v5':40B,42B,97C,210C,217C 'v5.0.0':220C 'v5.4.0':222C 'v5.4.1':227C 'valid':233C,241C 'valu':10A,53B,194C,246C 'version':213C 'w7rg':20A,25A 'whether':50B,100C 'workaround':257C 'x':3A,45B,106C,191C,243C 'x-real-ip':2A,44B,105C,190C,242C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T20:50:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-h53f-rm2w-w7rg","url":"https://github.com/advisories/GHSA-h53f-rm2w-w7rg","severity":"medium","published_at":"2026-10-23T20:50:25+00:00","modified_at":"2026-10-23T20:50:27+00:00","first_seen_at":"2026-10-23T20:59:05+00:00","fetched_at":"2026-10-23T20:59:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}