labstack echo vulnerabilities

Newest CVEs

• CVE-2026-118658

  Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto

  labstack · echo

  Medium4.7
• CVE-2026-118657

  Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers

  labstack · echo

  Medium5.9
• CVE-2026-118656

  Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI

  labstack · echo

  Medium6.1
• CVE-2026-118655

  Echo: Static Middleware Double-Unescape Path Traversal

  labstack · echo

  Medium5.9
• CVE-2026-118654

  Echo static file middleware route protection bypass via encoded dot-dot traversal

  labstack · echo

  Medium5.9
• CVE-2026-118653

  Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration

  labstack · echo

  Medium5.3
• CVE-2026-118652

  Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob

  labstack · echo

  Medium6.1
• CVE-2026-118651

  Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default

  labstack · echo

  Medium5.3
• CVE-2026-118650

  Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path

  labstack · echo

  High7.5
• CVE-2026-118266

  Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method

  labstack · echo

  Medium5.3