Security
فارسی
All products

github.com/labstack/echo/v4

Go · Package
17 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Echo: BodyDump captures request and response bodies without size limits in v4CVE-2026-118260 · GHSA-F48P-C9V4-H7XVVersion ranges need review. github.com/labstack/echo/v4 Go High Fix reported
Echo: Rejected WebSocket upgrades can bypass Echo route-level access controlsCVE-2026-118264 · GHSA-CXF3-9H37-7RR8Version ranges need review. github.com/labstack/echo/v4github.com/labstack/echo/v5 GoRed Hat Critical Fix reported
Echo: WebSocket proxy can retain connections and handlers after client disconnectCVE-2026-118262 · GHSA-9969-6676-49H5Version ranges need review. github.com/labstack/echo/v4github.com/labstack/echo/v5 Go High Fix reported
Echo: Decompress permits unbounded gzip expansion in v4CVE-2026-118261 · GHSA-H7WR-284F-5QVCVersion ranges need review. github.com/labstack/echo/v4 Go High Fix reported
Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served pathCVE-2026-118650 · GHSA-375P-5QHX-8WQ4Version ranges need review. github.com/labstack/echo/v4github.com/labstack/echo/v5 Go High Fix reported
Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme HeadersCVE-2026-118657 · GHSA-2FFQ-G2XG-C22PVersion ranges need review. github.com/labstack/echo/v4github.com/labstack/echo/v5 Go Medium Fix reported
Echo has a Static Middleware Double-Unescape Path TraversalCVE-2026-118655 · GHSA-XWQ5-6CQP-VX96Version ranges need review. github.com/labstack/echo/v4github.com/labstack/echo/v5 Go Medium Fix reported
Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURICVE-2026-118656 · GHSA-V753-G4CW-JM48Version ranges need review. github.com/labstack/echo/v4github.com/labstack/echo/v5 Go Medium Fix reported
Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-ProtoCVE-2026-118658 · GHSA-23WF-92CP-8PCJVersion ranges need review. github.com/labstack/echo/v4github.com/labstack/echo/v5 Go Medium Fix reported
Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlobCVE-2026-118652 · GHSA-H9G5-28MM-HX3GVersion ranges need review. github.com/labstack/echo/v4github.com/labstack/echo/v5 Go Medium Fix reported
Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default ConfigurationCVE-2026-118653 · GHSA-246P-CPWV-V3JQVersion ranges need review. github.com/labstack/echo/v4github.com/labstack/echo/v5 Go Medium Fix reported
Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe MethodCVE-2026-118266 · GHSA-R7W9-592Q-9VG4Version ranges need review. github.com/labstack/echo/v4github.com/labstack/echo/v5 Go Medium Fix reported
Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by DefaultCVE-2026-118651 · GHSA-99JH-6H7P-PP36Version ranges need review. github.com/labstack/echo/v4github.com/labstack/echo/v5 Go Medium Fix reported
Echo static file middleware route protection bypass via encoded dot-dot traversalCVE-2026-118654 · GHSA-3PMX-CF9F-34XRVersion ranges need review. github.com/labstack/echo/v4github.com/labstack/echo/v5 Go Medium Fix reported
Echo: Encoded slash (%2F) bypasses route-level protection and exposes static filesCVE-2026-55677 · GHSA-VFP3-V2GW-7WFQVersion ranges need review. github.com/labstack/echo/v4github.com/labstack/echo/v5 GoRed Hat High Fix reported
Labstack Echo Open Redirect vulnerabilityCVE-2022-40083 · GHSA-CRXJ-HRMP-4RWFVersion ranges need review. github.com/labstack/echo/v4 Go Critical Fix reported
Echo vulnerable to directory traversalCVE-2020-36565 · GHSA-J453-HM5X-C46WVersion ranges need review. github.com/labstack/echo/v4 Go Medium Fix reported