Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 5.3, published 23 October 2026.

Which products and versions are affected?

github.com/labstack/echo/v5 (Go) >= 5.0.0, < 5.4.1, SEMVER:introduced=5.0.0,fixed=5.4.1; Labstack Echo v5.0.0 through v5.4.0.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run github.com/labstack/echo/v5 (Go) or Labstack Echo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Echo X-Real-IP header spoofing vulnerability

Q: Is there a fix for This vulnerability?

Yes. github.com/labstack/echo/v5 (Go): upgrade to 5.4.1 or later. Until then: Use ExtractIPDirect instead of ExtractIPFromRealIPHeader until upgrading, or ensure that only trusted proxies can reach Echo and that they replace client-supplied forwarding headers with verified values. Configure trusted proxy ranges narrowly for your deployment. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a software library.

Q: Am I affected?

Check whether you run github.com/labstack/echo/v5 (Go) or Labstack Echo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: medium · CVSS 5.3 · Published 2026-10-23

Echo is a Go web framework used to build web applications and APIs. The X-Real-IP header extractor in Echo v5 trusts the client-supplied header value instead of verifying the actual network source, allowing attackers to spoof their IP address. Applications relying on this for access control, rate limiting, or audit logging could be bypassed or accept forged identities.

Technologies: github.com/labstack/echo/v5 (Go), Labstack Echo. Vendors: Go, Labstack.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 5.3, published 23 October 2026.
Which products and versions are affected?: github.com/labstack/echo/v5 (Go) >= 5.0.0, < 5.4.1, SEMVER:introduced=5.0.0,fixed=5.4.1; Labstack Echo v5.0.0 through v5.4.0.
Is there a fix for This vulnerability?: Yes. github.com/labstack/echo/v5 (Go): upgrade to 5.4.1 or later. Until then: Use ExtractIPDirect instead of ExtractIPFromRealIPHeader until upgrading, or ensure that only trusted proxies can reach Echo and that they replace client-supplied forwarding headers with verified values. Configure trusted proxy ranges narrowly for your deployment. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run github.com/labstack/echo/v5 (Go) or Labstack Echo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/labstack/echo/v5 (Go): upgrade to 5.4.1 or later
```
go get github.com/labstack/echo/v5@v5.4.1
```

Use ExtractIPDirect instead of ExtractIPFromRealIPHeader until upgrading, or ensure that only trusted proxies can reach Echo and that they replace client-supplied forwarding headers with verified values. Configure trusted proxy ranges narrowly for your deployment.

Technical details

The ExtractIPFromRealIPHeader function in Echo v5 validates whether an X-Real-IP value falls within a trusted range, but fails to verify that the header comes from a trusted peer—allowing any client to inject a spoofed address. An attacker can supply loopback (127.0.0.1) or private IP ranges to bypass IP-based controls. The vulnerability requires direct network access to Echo or an intervening proxy that passes through untrusted headers.

Affected products

labstack Echo v5.0.0 through v5.4.0

Timeline

2026-10-23: disclosed
2026-10-23: patched

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.