{"id":"ghsa-ghsa-h53f-rm2w-w7rg","seq":661331,"kind":"advisory","title":"Echo: X-Real-IP extractor trusts the header value instead of the sending peer","url":"https://github.com/advisories/GHSA-h53f-rm2w-w7rg","permalink":"https://vulnpulse.app/items/ghsa-ghsa-h53f-rm2w-w7rg","summary":"影響: go:github.com/labstack/echo/v5 >= 5.0.0, < 5.4.1 → 5.4.1\nIn Echo v5, ExtractIPFromRealIPHeader checked whether the address supplied in X-Real-IP belonged to a trusted range instead of checking the address of the direct network peer. An untrusted client could therefore supply a loopback or private address and have it returned by c.RealIP() with the extractor's default trust options. Applications using this extractor for IP allowlists, IP-based rate limiting, audit logs or forwarding headers could accept a spoofed client identity. Exploitation requires…","severity":"medium","techs":["go","github"],"cves":[],"tags":["GHSA-h53f-rm2w-w7rg","github.com/labstack/echo/v5"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T20:50:25.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}