CVE-2026-118265: falha de média gravidade em labstack echo
Echo: X-Real-IP extractor trusts the header value instead of the sending peer
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.1%
Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractIPFromRealIPHeader validates whether the client-supplied X-Real-IP value belongs to a trusted range instead of validating the direct network peer. A client reaching Echo directly, or through a proxy that preserves the header, can supply a loopback or private address and have Context.RealIP return that spoofed identity. Applications using the extractor for IP allowlists, rate limiting, audit logs, or forwarding headers can consequently trust an attacker-controlled address; the default direct extractor and Echo v4 are unaffected. This issue is fixed in 5.4.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
labstack · echoCVEs relacionadas — labstack echo
No mesmo produto, das mais perigosas para as menos.
CVE-2026-55677HIGHEcho: Encoded slash (%2F) bypasses route-level protection and exposes static filesEPSS 0.5%CVE-2026-118264CRITICALEcho: Rejected WebSocket upgrades can bypass Echo route-level access controlsEPSS 0.4%CVE-2026-118653MEDIUMEcho: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default ConfigurationEPSS 0.4%CVE-2026-118650HIGHEcho: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served pathEPSS 0.4%CVE-2026-118263MEDIUMEcho: BodyDump can discard BodyLimit overflow errors for unknown-length requestsEPSS 0.4%CVE-2026-25766MEDIUMEcho has a Windows path traversal via backslash in middleware.Static default filesystemEPSS 0.4%