{"id":"ghsa-ghsa-99jh-6h7p-pp36","seq":2056990,"kind":"advisory","title":"Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default","url":"https://github.com/advisories/GHSA-99jh-6h7p-pp36","permalink":"https://vulnpulse.app/items/ghsa-ghsa-99jh-6h7p-pp36","summary":"影響: go:github.com/labstack/echo/v5 < 5.4.0 → 5.4.0, go:github.com/labstack/echo/v4 >= 4.0.0, <= 4.16.2\nThe Echo proxy middleware (middleware/proxy.go) preserves an incoming X-Real-IP header verbatim and forwards it to the upstream service when Echo#IPExtractor is not configured — which is the default. Because any HTTP client can supply an arbitrary X-Real-IP value, an attacker can cause Echo to relay a spoofed client IP address to every upstream service behind the proxy, undermining upstream IP-based access controls, rate limiting, audit logging, and geo-restriction. Affected Component - middlew…","severity":"medium","techs":["go","github"],"cves":["CVE-2026-118651"],"tags":["GHSA-99jh-6h7p-pp36","github.com/labstack/echo/v5","github.com/labstack/echo/v4"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T19:53:24.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}