[ Vendor · 16 CVEs ]
labstack
CVEs affecting labstack published in the last 30 days, plus any labstack CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-118656 | 28 Oct 2026 | CVSS 6.1 | Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURIEcho is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first two bytes of a redirect target before deciding whether it… | Fix |
| CVE-2026-118657 | 28 Oct 2026 | CVSS 5.9 | Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme HeadersEcho is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trusts forwarded scheme headers from any client. A client that… | Fix |
| CVE-2026-118658 | 28 Oct 2026 | CVSS 4.7 | Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-ProtoEcho is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme… | Fix |
| CVE-2026-118651 | 28 Oct 2026 | CVSS 5.3 | Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by DefaultEcho is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an… | Fix |
| CVE-2026-118652 | 28 Oct 2026 | CVSS 6.1 | Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlobEcho is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated callback value into a… | Fix |
| CVE-2026-118653 | 28 Oct 2026 | CVSS 5.3 | Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default ConfigurationEcho is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-Forwarded-For or X-Real-IP values when… | Fix |
| CVE-2026-118654 | 28 Oct 2026 | CVSS 5.9 | Echo static file middleware route protection bypass via encoded dot-dot traversalEcho is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static file handlers can normalize dot segments after route matching and serve a file… | Fix |
| CVE-2026-118655 | 28 Oct 2026 | CVSS 5.9 | Echo has a Static Middleware Double-Unescape Path TraversalEcho is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded… | Fix |
| CVE-2026-118266 | 28 Oct 2026 | CVSS 5.3 | Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe MethodEcho is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOverride middleware accepts a safe HTTP method as the override target for a POST… | Fix |
| CVE-2026-118650 | 28 Oct 2026 | CVSS 7.5 | Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served pathEcho is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path… | Fix |
| CVE-2026-118263 | 28 Oct 2026 | CVSS 6.3 | Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requestsEcho is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's BodyDump middleware can discard a BodyLimit overflow error for an unknown-length… | Fix |
| CVE-2026-118264 | 28 Oct 2026 | CVSS 9.1 | Echo: Rejected WebSocket upgrades can bypass Echo route-level access controlsEcho is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request… | Fix |
| CVE-2026-118265 | 28 Oct 2026 | CVSS 5.3 | Echo: X-Real-IP extractor trusts the header value instead of the sending peerEcho is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractIPFromRealIPHeader validates whether the client-supplied X-Real-IP value belongs… | Fix |
| CVE-2026-118260 | 28 Oct 2026 | CVSS 8.2 | Echo: BodyDump captures request and response bodies without size limits in v4Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware reads complete request bodies into memory before handlers… | Fix |
| CVE-2026-118261 | 28 Oct 2026 | CVSS 8.2 | Echo: Decompress permits unbounded gzip expansion in v4Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded request stream without limiting… | Fix |
| CVE-2026-118262 | 28 Oct 2026 | CVSS 8.2 | Echo: WebSocket proxy can retain connections and handlers after client disconnectEcho is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network… | Fix |