Echo (Labstack) - vulnerabilities (CVEs)

18 CVEs, 16 in the last 30 days, 120 known versions, newest CVE from 2026-10-28. Vendor: Labstack.

CVEs of Echo

• CVE-2026-118658 - CVSS 4.7 (medium), 2026-10-28: Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme without…
• CVE-2026-118657 - CVSS 5.9 (medium), 2026-10-28: Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trusts forwarded scheme headers from any client. A client that reaches…
• CVE-2026-118656 - CVSS 6.1 (medium), 2026-10-28: Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first two bytes of a redirect target before deciding whether it begins with…
• CVE-2026-118655 - CVSS 5.9 (medium), 2026-10-28: Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded…
• CVE-2026-118654 - CVSS 5.9 (medium), 2026-10-28: Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static file handlers can normalize dot segments after route matching and serve a file through a…
• CVE-2026-118653 - CVSS 5.3 (medium), 2026-10-28: Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-Forwarded-For or X-Real-IP values when Echo.IPExtractor is…
• CVE-2026-118652 - CVSS 6.1 (medium), 2026-10-28: Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated callback value into a JavaScript…
• CVE-2026-118651 - CVSS 5.3 (medium), 2026-10-28: Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream…
• CVE-2026-118650 - CVSS 7.5 (high), 2026-10-28: Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path differently from…
• CVE-2026-118266 - CVSS 5.3 (medium), 2026-10-28: Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOverride middleware accepts a safe HTTP method as the override target for a POST request.…
• CVE-2026-118265 - CVSS 5.3 (medium), 2026-10-28: Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractIPFromRealIPHeader validates whether the client-supplied X-Real-IP value belongs to a…
• CVE-2026-118264 - CVSS 9.1 (critical), 2026-10-28: Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before…
• CVE-2026-118263 - CVSS 6.3 (medium), 2026-10-28: Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's BodyDump middleware can discard a BodyLimit overflow error for an unknown-length request when…
• CVE-2026-118262 - CVSS 8.2 (high), 2026-10-28: Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network connections after a…
• CVE-2026-118261 - CVSS 8.2 (high), 2026-10-28: Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded request stream without limiting its…
• CVE-2026-118260 - CVSS 8.2 (high), 2026-10-28: Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware reads complete request bodies into memory before handlers run and…
• CVE-2026-55677 - CVSS 7.5 (high), 2026-06-26: Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using…
• CVE-2026-25766 - CVSS 5.3 (medium), 2026-02-19: Echo is a Go web framework. In versions 5.0.0 through 5.0.2 on Windows, Echo’s `middleware.Static` using the default filesystem allows path traversal via…
• CVE-2020-36565 - CVSS 5.3 (medium), 2022-12-07: Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read files outside of…
• CVE-2022-40083 - CVSS 9.6 (critical), 2022-09-28: Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component. This vulnerability can be leveraged by…