Labstack Echo EUVD-2026-112397

Exploitable only when the application (1) runs Echo v5 between 5.0.0 and 5.4.0 and (2) explicitly uses the ExtractIPFromRealIPHeader extractor with default trust options for Context.RealIP - the default direct IP extractor (ExtractIPDirect) and Echo v4 are NOT affected. The attacker must be able to reach Echo directly or send requests through an intervening proxy that passes the client-supplied X-Real-IP value through unchanged; a correctly configured reverse proxy that overwrites/strips X-Real-IP neutralizes the attack. Impact materializes only where RealIP feeds a security or accounting decision - IP allowlists, IP-based rate limiting, audit logs, or forwarding headers. Limiting factors: requires the non-default extractor configuration, requires a header-preserving path to Echo, and yields only a spoofed identity (no code execution or data read). Vendor-stated workarounds until upgrading: use ExtractIPDirect, or ensure only trusted proxies can reach Echo and that they replace client-supplied forwarding headers, with trusted proxy ranges configured narrowly.

This is a medium-severity (CVSS 5.3) identity-spoofing regression, not a critical priority. The provided CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) is internally consistent with the GHSA: network-reachable, no authentication, and a single low integrity impact (a spoofed client identity) with no confidentiality or availability impact. The vuln.today decision label is 'this_month' rather than act_now/emergency, which aligns with the signal set. No EPSS score was supplied and the CVE is not listed in CISA KEV, so there is no evidence of active exploitation - exploitation status is 'no public exploit identified at time of analysis' (the provided references are the vendor fix commit, the v5.4.1 release, and the GHSA advisory - patch artifacts, not proof-of-concept exploit code). The real-world risk is tightly scoped: it only affects applications that both run Echo v5 (5.0.0-5.4.0) AND opt into the non-default ExtractIPFromRealIPHeader extractor; the default direct extractor and all of Echo v4 are unaffected per the vendor. The CVSS AV:N is accurate but should be read alongside the exploitation precondition that an attacker must reach Echo directly or traverse a proxy that passes the client-supplied X-Real-IP through unchanged - a condition the CVSS base metrics do not capture. Net: a legitimate issue to patch on a normal cadence for affected deployments, not a drop-everything emergency.

An application runs Echo v5 configured to derive client IP via ExtractIPFromRealIPHeader and uses c.RealIP() for an IP allowlist or rate-limit bucket. An unauthenticated attacker who can reach Echo directly (or through a proxy that forwards the header) sends a request carrying X-Real-IP: 127.0.0.1, causing RealIP to return the spoofed loopback address and bypass the allowlist or poison audit logs. No public exploit code was identified, though the fix commit's added test cases demonstrate the exact spoofing inputs (127.0.0.1 and 10.240.0.1).