What’s Vulnerable › Products
labstack echo vulnerabilities
20 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 18 published in the last 12 months.
Check whether your labstack echo version is affected
Latest labstack echo vulnerabilities
- CVE-2026-118658 — Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto (CVSS 4.7)
- CVE-2026-118657 — Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers (CVSS 5.9)
- CVE-2026-118656 — Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI (CVSS 6.1)
- CVE-2026-118655 — Echo: Static Middleware Double-Unescape Path Traversal (CVSS 5.9)
- CVE-2026-118654 — Echo static file middleware route protection bypass via encoded dot-dot traversal (CVSS 5.9)
- CVE-2026-118653 — Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration (CVSS 5.3)
- CVE-2026-118652 — Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob (CVSS 6.1)
- CVE-2026-118651 — Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default (CVSS 5.3)
- CVE-2026-118650 — Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path (CVSS 7.5)
- CVE-2026-118266 — Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method (CVSS 5.3)
- CVE-2026-118265 — Echo: X-Real-IP extractor trusts the header value instead of the sending peer (CVSS 5.3)
- CVE-2026-118264 — Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls (CVSS 9.1)
- CVE-2026-118263 — Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests (CVSS 6.3)
- CVE-2026-118262 — Echo: WebSocket proxy can retain connections and handlers after client disconnect (CVSS 8.2)
- CVE-2026-118261 — Echo: Decompress permits unbounded gzip expansion in v4 (CVSS 8.2)
- CVE-2026-118260 — Echo: BodyDump captures request and response bodies without size limits in v4 (CVSS 8.2)
- CVE-2026-55677 — Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files (CVSS 7.5)
- CVE-2026-25766 — Echo has a Windows path traversal via backslash in middleware.Static default filesystem (CVSS 5.3)
- CVE-2020-36565 — Directory traversal on Windows in github.com/labstack/echo/v4 (CVSS 5.3)
- CVE-2022-40083 — (CVSS 9.6)