Every CVE Search/ Get API key

CVE-2026-55677

Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files

7.5 HighFix available

Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an attacker to bypass route-level access controls and read static files without authorization. This vulnerability is fixed in 4.15.3 and 5.2.0.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.52%Up 0.1 points since Jun 27, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files

Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an attacker to bypass route-level access controls and read static files without authorization. This vulnerability is fixed in 4.15.3 and 5.2.0.

Record
CVE-2026-55677
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
EUVDEUVD-2026-39800 7.5

Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an attacker to bypass route-level access controls and read static files without authorization. This vulnerability is fixed in 4.15.3 and 5.2.0.

Record
EUVD-2026-39800
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-vfp3-v2gw-7wfq 7.5

Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files

Summary

Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an attacker to bypass route-level access controls and read static files without authorization.

Details

Root cause 1 — router.go lines 798-802: The router uses req.URL.RawPath for route matching when useEscapedPathForRouting is false (the default). This means /admin%2Fsecret.txt is treated as a single path segment and does NOT match the /admin/* route pattern.

if !r.useEscapedPathForRouting && req.URL.RawPath != "" {
    path = req.URL.RawPath
}

Root cause 2 — echo.go lines 559-568: StaticDirectoryHandler calls url.PathUnescape() on the path parameter before opening files. This converts %2F back to /, resolving admin/secret.txt on disk.

if !disablePathUnescaping {
    tmpPath, err := url.PathUnescape(p)
    p = tmpPath
}
name := filepath.ToSlash(filepath.Clean(strings.TrimPrefix(p, "/")))

PoC (Screenshot)

Sample: <img width="1291" height="970" alt="image" src="https://github.com/user-attachments/assets/0bc58059-3e6d-4678-ab25-a5c79b006738" />

403: <img width="526" height="194" alt="image" src="https://github.com/user-attachments/assets/2f55ffdd-87b2-4a1b-8a13-130ebad0f257" />

Bypass with encoded slash: <img width="592" height="203" alt="image" src="https://github.com/user-attachments/assets/1191cd39-ae8f-4d7e-8fb1-cb9cf31f484f" />

Impact

Unauthorized static file disclosure. Applications that protect route prefixes with authentication middleware while also serving static files from a broader root are vulnerable. An attacker only needs to encode the slash (/ → %2F) in the URL to bypass all route-level protection.

Common affected pattern:

adminGroup := e.Group("/admin", authMiddleware)
e.StaticFS("/", os.DirFS("public"))
Record
GHSA-vfp3-v2gw-7wfq
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
NVD 7.5

Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an attacker to bypass route-level access controls and read static files without authorization. This vulnerability is fixed in 4.15.3 and 5.2.0.

Record
CVE-2026-55677
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
OSV 7.5

Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files

Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an attacker to bypass route-level access controls and read static files without authorization. This vulnerability is fixed in 4.15.3 and 5.2.0.

Record
CVE-2026-55677
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
OSVDEBIAN-CVE-2026-55677 7.5

Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an attacker to bypass route-level access controls and read static files without authorization. This vulnerability is fixed in 4.15.3 and 5.2.0.

Record
DEBIAN-CVE-2026-55677
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 20 moreShow less
OSVGHSA-vfp3-v2gw-7wfq 7.5

Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files

Summary

Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an attacker to bypass route-level access controls and read static files without authorization.

Details

Root cause 1 — router.go lines 798-802: The router uses req.URL.RawPath for route matching when useEscapedPathForRouting is false (the default). This means /admin%2Fsecret.txt is treated as a single path segment and does NOT match the /admin/* route pattern.

if !r.useEscapedPathForRouting && req.URL.RawPath != "" {
    path = req.URL.RawPath
}

Root cause 2 — echo.go lines 559-568: StaticDirectoryHandler calls url.PathUnescape() on the path parameter before opening files. This converts %2F back to /, resolving admin/secret.txt on disk.

if !disablePathUnescaping {
    tmpPath, err := url.PathUnescape(p)
    p = tmpPath
}
name := filepath.ToSlash(filepath.Clean(strings.TrimPrefix(p, "/")))

PoC (Screenshot)

Sample: <img width="1291" height="970" alt="image" src="https://github.com/user-attachments/assets/0bc58059-3e6d-4678-ab25-a5c79b006738" />

403: <img width="526" height="194" alt="image" src="https://github.com/user-attachments/assets/2f55ffdd-87b2-4a1b-8a13-130ebad0f257" />

Bypass with encoded slash: <img width="592" height="203" alt="image" src="https://github.com/user-attachments/assets/1191cd39-ae8f-4d7e-8fb1-cb9cf31f484f" />

Impact

Unauthorized static file disclosure. Applications that protect route prefixes with authentication middleware while also serving static files from a broader root are vulnerable. An attacker only needs to encode the slash (/ → %2F) in the URL to bypass all route-level protection.

Common affected pattern:

adminGroup := e.Group("/admin", authMiddleware)
e.StaticFS("/", os.DirFS("public"))
Record
GHSA-vfp3-v2gw-7wfq
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
OSVRHSA-2026:57541 8.2

Red Hat Security Advisory: osbuild-composer security update

Record
RHSA-2026:57541
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:61585 8.1

Red Hat Security Advisory: osbuild-composer security update

Record
RHSA-2026:61585
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:63134 8.2

Red Hat Security Advisory: osbuild-composer security update

Record
RHSA-2026:63134
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:66432 8.2

Red Hat Security Advisory: osbuild-composer security update

Record
RHSA-2026:66432
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:67148 7.5

Red Hat Security Advisory: osbuild-composer security update

Record
RHSA-2026:67148
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:69293 8.1

Red Hat Security Advisory: osbuild-composer security update

Record
RHSA-2026:69293
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:66432 8.2

Important: osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

  • golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)

  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)

  • golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)

  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502)

  • github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)

  • github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:66432
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:67148 7.5

Important: osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

  • crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec (CVE-2025-22866)

  • crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)

  • net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)

  • mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)

  • github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)

  • github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:67148
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:69293 8.1

Important: osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)

  • golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)

  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502)

  • github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)

  • github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:69293
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-55677 7.5

Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an attacker to bypass route-level access controls and read static files without authorization. This vulnerability is fixed in 4.15.3 and 5.2.0.

Record
UBUNTU-CVE-2026-55677
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVALSA-2026:66432 No score

Important: osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

  • golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)
  • golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)
  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502)
  • github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)
  • github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:66432
Updated
2026-11-02
OSVALSA-2026:67148 No score

Important: osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

  • crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec (CVE-2025-22866)
  • crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)
  • net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)
  • mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)
  • github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)
  • github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:67148
Updated
2026-11-02
OSVALSA-2026:69293 No score

Important: osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)
  • golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)
  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502)
  • github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)
  • github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:69293
Updated
2026-11-02
OSVCLSA-2026-1790266264 No score

osbuild-composer: Fix of CVE-2026-55677

  • CVE-2026-55677: reject percent-encoded path separators (%2F, %5C) in the static file wildcard before unescaping it, in StaticDirectoryHandler and StaticWithConfig of the vendored github.com/labstack/echo/v4, so that an encoded separator cannot smuggle a path segment past the router and disclose a static file protected by route-level middleware
Record
CLSA-2026-1790266264
Updated
2026-11-02
OSVCLSA-2026-1790972556 No score

osbuild-composer: Fix of CVE-2026-55677

  • CVE-2026-55677: stop unescaping the static file wildcard by default in Static, StaticFS, Group.StaticFS and StaticWithConfig of the vendored github.com/labstack/echo/v4 (the echo v4.15.4 fix), so an encoded separator (%2F, %5C) or dot-segment (%2E%2E) cannot resolve a static file outside the route the router matched and bypass route-level middleware; unescaping is opt-in via EnablePathUnescapingStaticFiles and StaticConfig.EnablePathUnescaping
Record
CLSA-2026-1790972556
Updated
2026-11-02
OSVGO-2026-6293 No score

Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

Record
GO-2026-6293
Updated
2026-11-02
OSVopenSUSE-SU-2026:21761-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20260827T195228 2026-08-27T19:52:28Z (jsc#PED-11136).

    Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2026-5026 CVE-2026-39821
    • GO-2026-6225
    • GO-2026-6250 CVE-2026-63328 GHSA-8rc5-4fr6-64pw
    • GO-2026-6253 CVE-2026-17106 GHSA-hfg8-hc9c-6c3h
    • GO-2026-6254 CVE-2026-53941 GHSA-vjhx-2cqw-3q6q
    • GO-2026-6255 CVE-2026-61711 GHSA-7236-3392-c5c6
    • GO-2026-6256 CVE-2026-61712 GHSA-72x6-4j93-7w86
    • GO-2026-6258 CVE-2026-45404 GHSA-42cj-99w8-cp2p
    • GO-2026-6259 CVE-2026-32637 GHSA-j2g6-362q-6qc6
    • GO-2026-6260 CVE-2026-55149 GHSA-qqff-5854-px68
    • GO-2026-6261 CVE-2026-54061 GHSA-rrwh-6jrq-wp5v
    • GO-2026-6262 GHSA-22w5-2fxg-vrwx
    • GO-2026-6263 CVE-2026-54168 GHSA-6f2p-296r-cc28
    • GO-2026-6264 CVE-2026-54245 GHSA-7q96-f8xw-jv5j
    • GO-2026-6265 GHSA-8fxq-53rx-ph5f
    • GO-2026-6266 CVE-2026-54167 GHSA-f5f4-3hh4-f54m
    • GO-2026-6267 GHSA-h58c-xccx-75m3
    • GO-2026-6268 GHSA-q9c5-pp7m-fm2g
    • GO-2026-6269 GHSA-rxhg-vcww-2mpw
    • GO-2026-6270 CVE-2026-54162 GHSA-x3g7-qrwc-f6c5
    • GO-2026-6271 CVE-2026-67448 GHSA-8r62-w5wh-fc5m
    • GO-2026-6272 CVE-2026-67447 GHSA-r553-m4fv-5v97
    • GO-2026-6273 CVE-2026-64679 GHSA-26w5-6g95-gj28
    • GO-2026-6274 CVE-2026-76905 GHSA-mmfr-pmjx-hw9w
    • GO-2026-6275 CVE-2026-77354 GHSA-xhj3-7xw9-vr34
    • GO-2026-6277 GHSA-4ph6-mjv7-3fq6
    • GO-2026-6278 GHSA-w67g-5rqw-f597
    • GO-2026-6279 CVE-2026-6046 GHSA-3vmp-whvv-5v9v
    • GO-2026-6280 CVE-2026-7387 GHSA-6hxm-w4hv-vgvw
    • GO-2026-6281 CVE-2026-6961 GHSA-8qq9-cqj8-82w4
    • GO-2026-6282 CVE-2026-7184 GHSA-9p44-r552-4wp9
    • GO-2026-6283 CVE-2026-6689 GHSA-c28q-m4gf-vg4q
    • GO-2026-6284 CVE-2026-55477 GHSA-jm48-m3rr-9hgg
    • GO-2026-6285 CVE-2026-6739 GHSA-m2w9-h2mm-79qr
    • GO-2026-6286 CVE-2026-3433 GHSA-rp4v-qc77-phm4
    • GO-2026-6287 GHSA-vx2m-jpxr-xv7w
    • GO-2026-6288 CVE-2026-11624 GHSA-76g7-m3xw-x9gr
    • GO-2026-6289 GHSA-w8j7-39hp-8x59
    • GO-2026-6290 CVE-2026-55581 GHSA-3x77-wg38-92r3
    • GO-2026-6291 CVE-2026-55582 GHSA-74hp-mggr-hv58
    • GO-2026-6292 CVE-2026-55580 GHSA-f5pj-2738-996m
    • GO-2026-6293 CVE-2026-55677 GHSA-vfp3-v2gw-7wfq
    • GO-2026-6294 CVE-2026-55092 GHSA-mcj4-mphf-j9ff
    • GO-2026-6295 CVE-2026-55637 GHSA-cmwv-wf9p-p8wx
    • GO-2026-6296 CVE-2026-54523 GHSA-79gf-7frw-68m9
    • GO-2026-6297 CVE-2026-50879 GHSA-g743-m6x3-v6wm
    • GO-2026-6298 CVE-2026-54563 GHSA-w5fv-7x5q-g8qp
    • GO-2026-6299 CVE-2026-50884 GHSA-5442-mh7f-72px
    • GO-2026-6300 CVE-2026-50891 GHSA-rcqf-cpv9-g5jf
    • GO-2026-6301 CVE-2026-42350 GHSA-g7gw-m874-7rmf

  • Update to version 0.0.20260819T170606 2026-08-19T17:06:06Z.

    Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2026-4720 GHSA-v3mg-9v85-fcm7
    • GO-2026-4942 CVE-2026-35172 GHSA-f2g3-hh2r-cwgc
    • GO-2026-4950
    • GO-2026-6093 GHSA-464c-974j-9xm6
    • GO-2026-6094 GHSA-gcjh-h69q-9w9g
    • GO-2026-6095 GHSA-r277-6w6q-xmqw
    • GO-2026-6097 CVE-2026-55495 GHSA-49h3-cwhj-4737
    • GO-2026-6098 CVE-2026-55496 GHSA-8r7f-r8hj-r3rv
    • GO-2026-6099 CVE-2026-57497 GHSA-g35j-m5xg-vh3q
    • GO-2026-6100 CVE-2026-55497 GHSA-g9j2-8w95-3vwv
    • GO-2026-6101 CVE-2026-55502 GHSA-hq88-5x99-x3gf
    • GO-2026-6102 CVE-2026-55499 GHSA-w8x7-h2px-xmq8
    • GO-2026-6103 CVE-2026-73564 GHSA-26gq-p25f-99cp
    • GO-2026-6104 CVE-2026-62323 GHSA-c3jm-gv5r-9wcp
    • GO-2026-6105 GHSA-c534-2w9c-x7fm
    • GO-2026-6106 GHSA-v6w6-358x-2433
    • GO-2026-6107 CVE-2026-73500 GHSA-6vch-q96h-7gc3
    • GO-2026-6108 CVE-2026-73505 GHSA-6xj8-qv9j-xcjq
    • GO-2026-6109 GHSA-86cx-wwf4-phq4
    • GO-2026-6110 CVE-2026-73509 GHSA-95cv-r8x4-vh75
    • GO-2026-6111 CVE-2026-73506 GHSA-fwjx-9p69-h25h
    • GO-2026-6112 CVE-2026-73502 GHSA-jpcw-4wr7-c3vq
    • GO-2026-6113 GHSA-p6ph-3jx2-3337
    • GO-2026-6114 CVE-2026-73499 GHSA-xg4h-6gfc-h4m8
    • GO-2026-6115 CVE-2026-56867
    • GO-2026-6117 GHSA-hp74-gm6m-2qm5
    • GO-2026-6118 CVE-2026-47427 GHSA-w4q6-qw23-4rg7
    • GO-2026-6119 CVE-2026-43983…
Record
openSUSE-SU-2026:21761-1
Updated
2026-11-02
OSVROOT-APP-GOBINARY-CVE-2026-55677 No score

CVE-2026-55677 in github.com/labstack/echo/v4 - Patched by Root

Root has patched CVE-2026-55677 in the github.com/labstack/echo/v4 package for Root:Go. Multiple fixed versions available.

Record
ROOT-APP-GOBINARY-CVE-2026-55677
Updated
2026-11-02
OSVSUSE-SU-2026:23625-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20260827T195228 2026-08-27T19:52:28Z (jsc#PED-11136).

    Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2026-5026 CVE-2026-39821
    • GO-2026-6225
    • GO-2026-6250 CVE-2026-63328 GHSA-8rc5-4fr6-64pw
    • GO-2026-6253 CVE-2026-17106 GHSA-hfg8-hc9c-6c3h
    • GO-2026-6254 CVE-2026-53941 GHSA-vjhx-2cqw-3q6q
    • GO-2026-6255 CVE-2026-61711 GHSA-7236-3392-c5c6
    • GO-2026-6256 CVE-2026-61712 GHSA-72x6-4j93-7w86
    • GO-2026-6258 CVE-2026-45404 GHSA-42cj-99w8-cp2p
    • GO-2026-6259 CVE-2026-32637 GHSA-j2g6-362q-6qc6
    • GO-2026-6260 CVE-2026-55149 GHSA-qqff-5854-px68
    • GO-2026-6261 CVE-2026-54061 GHSA-rrwh-6jrq-wp5v
    • GO-2026-6262 GHSA-22w5-2fxg-vrwx
    • GO-2026-6263 CVE-2026-54168 GHSA-6f2p-296r-cc28
    • GO-2026-6264 CVE-2026-54245 GHSA-7q96-f8xw-jv5j
    • GO-2026-6265 GHSA-8fxq-53rx-ph5f
    • GO-2026-6266 CVE-2026-54167 GHSA-f5f4-3hh4-f54m
    • GO-2026-6267 GHSA-h58c-xccx-75m3
    • GO-2026-6268 GHSA-q9c5-pp7m-fm2g
    • GO-2026-6269 GHSA-rxhg-vcww-2mpw
    • GO-2026-6270 CVE-2026-54162 GHSA-x3g7-qrwc-f6c5
    • GO-2026-6271 CVE-2026-67448 GHSA-8r62-w5wh-fc5m
    • GO-2026-6272 CVE-2026-67447 GHSA-r553-m4fv-5v97
    • GO-2026-6273 CVE-2026-64679 GHSA-26w5-6g95-gj28
    • GO-2026-6274 CVE-2026-76905 GHSA-mmfr-pmjx-hw9w
    • GO-2026-6275 CVE-2026-77354 GHSA-xhj3-7xw9-vr34
    • GO-2026-6277 GHSA-4ph6-mjv7-3fq6
    • GO-2026-6278 GHSA-w67g-5rqw-f597
    • GO-2026-6279 CVE-2026-6046 GHSA-3vmp-whvv-5v9v
    • GO-2026-6280 CVE-2026-7387 GHSA-6hxm-w4hv-vgvw
    • GO-2026-6281 CVE-2026-6961 GHSA-8qq9-cqj8-82w4
    • GO-2026-6282 CVE-2026-7184 GHSA-9p44-r552-4wp9
    • GO-2026-6283 CVE-2026-6689 GHSA-c28q-m4gf-vg4q
    • GO-2026-6284 CVE-2026-55477 GHSA-jm48-m3rr-9hgg
    • GO-2026-6285 CVE-2026-6739 GHSA-m2w9-h2mm-79qr
    • GO-2026-6286 CVE-2026-3433 GHSA-rp4v-qc77-phm4
    • GO-2026-6287 GHSA-vx2m-jpxr-xv7w
    • GO-2026-6288 CVE-2026-11624 GHSA-76g7-m3xw-x9gr
    • GO-2026-6289 GHSA-w8j7-39hp-8x59
    • GO-2026-6290 CVE-2026-55581 GHSA-3x77-wg38-92r3
    • GO-2026-6291 CVE-2026-55582 GHSA-74hp-mggr-hv58
    • GO-2026-6292 CVE-2026-55580 GHSA-f5pj-2738-996m
    • GO-2026-6293 CVE-2026-55677 GHSA-vfp3-v2gw-7wfq
    • GO-2026-6294 CVE-2026-55092 GHSA-mcj4-mphf-j9ff
    • GO-2026-6295 CVE-2026-55637 GHSA-cmwv-wf9p-p8wx
    • GO-2026-6296 CVE-2026-54523 GHSA-79gf-7frw-68m9
    • GO-2026-6297 CVE-2026-50879 GHSA-g743-m6x3-v6wm
    • GO-2026-6298 CVE-2026-54563 GHSA-w5fv-7x5q-g8qp
    • GO-2026-6299 CVE-2026-50884 GHSA-5442-mh7f-72px
    • GO-2026-6300 CVE-2026-50891 GHSA-rcqf-cpv9-g5jf
    • GO-2026-6301 CVE-2026-42350 GHSA-g7gw-m874-7rmf

  • Update to version 0.0.20260819T170606 2026-08-19T17:06:06Z.

    Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2026-4720 GHSA-v3mg-9v85-fcm7
    • GO-2026-4942 CVE-2026-35172 GHSA-f2g3-hh2r-cwgc
    • GO-2026-4950
    • GO-2026-6093 GHSA-464c-974j-9xm6
    • GO-2026-6094 GHSA-gcjh-h69q-9w9g
    • GO-2026-6095 GHSA-r277-6w6q-xmqw
    • GO-2026-6097 CVE-2026-55495 GHSA-49h3-cwhj-4737
    • GO-2026-6098 CVE-2026-55496 GHSA-8r7f-r8hj-r3rv
    • GO-2026-6099 CVE-2026-57497 GHSA-g35j-m5xg-vh3q
    • GO-2026-6100 CVE-2026-55497 GHSA-g9j2-8w95-3vwv
    • GO-2026-6101 CVE-2026-55502 GHSA-hq88-5x99-x3gf
    • GO-2026-6102 CVE-2026-55499 GHSA-w8x7-h2px-xmq8
    • GO-2026-6103 CVE-2026-73564 GHSA-26gq-p25f-99cp
    • GO-2026-6104 CVE-2026-62323 GHSA-c3jm-gv5r-9wcp
    • GO-2026-6105 GHSA-c534-2w9c-x7fm
    • GO-2026-6106 GHSA-v6w6-358x-2433
    • GO-2026-6107 CVE-2026-73500 GHSA-6vch-q96h-7gc3
    • GO-2026-6108 CVE-2026-73505 GHSA-6xj8-qv9j-xcjq
    • GO-2026-6109 GHSA-86cx-wwf4-phq4
    • GO-2026-6110 CVE-2026-73509 GHSA-95cv-r8x4-vh75
    • GO-2026-6111 CVE-2026-73506 GHSA-fwjx-9p69-h25h
    • GO-2026-6112 CVE-2026-73502 GHSA-jpcw-4wr7-c3vq
    • GO-2026-6113 GHSA-p6ph-3jx2-3337
    • GO-2026-6114 CVE-2026-73499 GHSA-xg4h-6gfc-h4m8
    • GO-2026-6115 CVE-2026-56867
    • GO-2026-6117 GHSA-hp74-gm6m-2qm5
    • GO-2026-6118 CVE-2026-47427 GHSA-w4q6-qw23-4rg7
    • GO-2026-6119 CVE-2026-43983…
Record
SUSE-SU-2026:23625-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/labstack/echo/v5
Go
 before 5.2.0
5.2.0
github.com/labstack/echo/v4
Go
 before 4.15.3
4.15.3
github.com/labstack/echo
Go
 through 3.3.10 None known
osbuild-composer
AlmaLinux:10
From an advisory covering 6 CVEs
 before 165.1-5.el10_2.alma.1
165.1-5.el10_2.alma.1
osbuild-composer-core
AlmaLinux:10
From an advisory covering 6 CVEs
 before 165.1-5.el10_2.alma.1
165.1-5.el10_2.alma.1
osbuild-composer-worker
AlmaLinux:10
From an advisory covering 6 CVEs
 before 165.1-5.el10_2.alma.1
165.1-5.el10_2.alma.1
osbuild-composer
AlmaLinux:8
From an advisory covering 6 CVEs
 before 101.5-3.el8_10.alma.1
101.5-3.el8_10.alma.1
osbuild-composer-core
AlmaLinux:8
From an advisory covering 6 CVEs
 before 101.5-3.el8_10.alma.1
101.5-3.el8_10.alma.1
osbuild-composer-worker
AlmaLinux:8
From an advisory covering 6 CVEs
 before 101.5-3.el8_10.alma.1
101.5-3.el8_10.alma.1
osbuild-composer
AlmaLinux:9
From an advisory covering 5 CVEs
 before 165.1-5.el9_8.alma.1
165.1-5.el9_8.alma.1
Show 79 moreShow less
Affected packages
PackageAffectedFixed
osbuild-composer-core
AlmaLinux:9
From an advisory covering 5 CVEs
 before 165.1-5.el9_8.alma.1
165.1-5.el9_8.alma.1
osbuild-composer-worker
AlmaLinux:9
From an advisory covering 5 CVEs
 before 165.1-5.el9_8.alma.1
165.1-5.el9_8.alma.1
osbuild-composer
TuxCare:AlmaLinux:9.6
 before 132.2-3.el9_6.alma.1.tuxcare.els11
132.2-3.el9_6.alma.1.tuxcare.els11
osbuild-composer-core
TuxCare:AlmaLinux:9.6
 before 132.2-3.el9_6.alma.1.tuxcare.els11
132.2-3.el9_6.alma.1.tuxcare.els11
osbuild-composer-tests
TuxCare:AlmaLinux:9.6
 before 132.2-3.el9_6.alma.1.tuxcare.els11
132.2-3.el9_6.alma.1.tuxcare.els11
osbuild-composer-worker
TuxCare:AlmaLinux:9.6
 before 132.2-3.el9_6.alma.1.tuxcare.els11
132.2-3.el9_6.alma.1.tuxcare.els11
osbuild-composer
TuxCare:AlmaLinux:9.2
 before 76-2.el9_2.2.alma.tuxcare.els12
76-2.el9_2.2.alma.tuxcare.els12
osbuild-composer-core
TuxCare:AlmaLinux:9.2
 before 76-2.el9_2.2.alma.tuxcare.els12
76-2.el9_2.2.alma.tuxcare.els12
osbuild-composer-dnf-json
TuxCare:AlmaLinux:9.2
 before 76-2.el9_2.2.alma.tuxcare.els12
76-2.el9_2.2.alma.tuxcare.els12
osbuild-composer-tests
TuxCare:AlmaLinux:9.2
 before 76-2.el9_2.2.alma.tuxcare.els12
76-2.el9_2.2.alma.tuxcare.els12
osbuild-composer-worker
TuxCare:AlmaLinux:9.2
 before 76-2.el9_2.2.alma.tuxcare.els12
76-2.el9_2.2.alma.tuxcare.els12
golang-github-labstack-echo
Debian:12
 All versions, plus listed versions
4.11.1-14.11.1-24.12.0-14.2.1-3
 None known
golang-github-labstack-echo
Debian:13
 All versions, plus listed versions
4.12.0-1
 None known
golang-github-labstack-echo
Debian:14
 All versions, plus listed versions
4.12.0-1
 None known
osbuild-composer
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 0:132.2-10.el9_6
0:132.2-10.el9_6
osbuild-composer-core
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 0:132.2-10.el9_6
0:132.2-10.el9_6
osbuild-composer-core-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 0:132.2-10.el9_6
0:132.2-10.el9_6
osbuild-composer-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 0:132.2-10.el9_6
0:132.2-10.el9_6
osbuild-composer-debugsource
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 0:132.2-10.el9_6
0:132.2-10.el9_6
osbuild-composer-tests-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 0:132.2-10.el9_6
0:132.2-10.el9_6
osbuild-composer-worker
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 0:132.2-10.el9_6
0:132.2-10.el9_6
osbuild-composer-worker-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 0:132.2-10.el9_6
0:132.2-10.el9_6
osbuild-composer
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 4 CVEs
 before 0:76.1-8.el9_2
0:76.1-8.el9_2
osbuild-composer-core
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 4 CVEs
 before 0:76.1-8.el9_2
0:76.1-8.el9_2
osbuild-composer-core-debuginfo
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 4 CVEs
 before 0:76.1-8.el9_2
0:76.1-8.el9_2
osbuild-composer-debuginfo
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 4 CVEs
 before 0:76.1-8.el9_2
0:76.1-8.el9_2
osbuild-composer-debugsource
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 4 CVEs
 before 0:76.1-8.el9_2
0:76.1-8.el9_2
osbuild-composer-dnf-json
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 4 CVEs
 before 0:76.1-8.el9_2
0:76.1-8.el9_2
osbuild-composer-tests-debuginfo
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 4 CVEs
 before 0:76.1-8.el9_2
0:76.1-8.el9_2
osbuild-composer-worker
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 4 CVEs
 before 0:76.1-8.el9_2
0:76.1-8.el9_2
osbuild-composer-worker-debuginfo
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 4 CVEs
 before 0:76.1-8.el9_2
0:76.1-8.el9_2
osbuild-composer
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 5 CVEs
 before 0:134.1-10.el10_0
0:134.1-10.el10_0
osbuild-composer-core
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 5 CVEs
 before 0:134.1-10.el10_0
0:134.1-10.el10_0
osbuild-composer-core-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 5 CVEs
 before 0:134.1-10.el10_0
0:134.1-10.el10_0
osbuild-composer-debugsource
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 5 CVEs
 before 0:134.1-10.el10_0
0:134.1-10.el10_0
osbuild-composer-tests-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 5 CVEs
 before 0:134.1-10.el10_0
0:134.1-10.el10_0
osbuild-composer-worker
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 5 CVEs
 before 0:134.1-10.el10_0
0:134.1-10.el10_0
osbuild-composer-worker-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 5 CVEs
 before 0:134.1-10.el10_0
0:134.1-10.el10_0
osbuild-composer
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:165.1-5.el10_2
0:165.1-5.el10_2
osbuild-composer-core
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:165.1-5.el10_2
0:165.1-5.el10_2
osbuild-composer-core-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:165.1-5.el10_2
0:165.1-5.el10_2
osbuild-composer-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:165.1-5.el10_2
0:165.1-5.el10_2
osbuild-composer-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:165.1-5.el10_2
0:165.1-5.el10_2
osbuild-composer-tests-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:165.1-5.el10_2
0:165.1-5.el10_2
osbuild-composer-worker
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:165.1-5.el10_2
0:165.1-5.el10_2
osbuild-composer-worker-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:165.1-5.el10_2
0:165.1-5.el10_2
osbuild-composer
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:101.5-3.el8_10
0:101.5-3.el8_10
osbuild-composer-core
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:101.5-3.el8_10
0:101.5-3.el8_10
osbuild-composer-core-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:101.5-3.el8_10
0:101.5-3.el8_10
osbuild-composer-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:101.5-3.el8_10
0:101.5-3.el8_10
osbuild-composer-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:101.5-3.el8_10
0:101.5-3.el8_10
osbuild-composer-tests-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:101.5-3.el8_10
0:101.5-3.el8_10
osbuild-composer-worker
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:101.5-3.el8_10
0:101.5-3.el8_10
osbuild-composer-worker-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:101.5-3.el8_10
0:101.5-3.el8_10
osbuild-composer
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:165.1-5.el9_8
0:165.1-5.el9_8
osbuild-composer-core
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:165.1-5.el9_8
0:165.1-5.el9_8
osbuild-composer-core-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:165.1-5.el9_8
0:165.1-5.el9_8
osbuild-composer-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:165.1-5.el9_8
0:165.1-5.el9_8
osbuild-composer-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:165.1-5.el9_8
0:165.1-5.el9_8
osbuild-composer-tests-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:165.1-5.el9_8
0:165.1-5.el9_8
osbuild-composer-worker
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:165.1-5.el9_8
0:165.1-5.el9_8
osbuild-composer-worker-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:165.1-5.el9_8
0:165.1-5.el9_8
osbuild-composer
Rocky Linux:10
From an advisory covering 6 CVEs
 before 0:165.1-5.el10_2.rocky.0.1
0:165.1-5.el10_2.rocky.0.1
osbuild-composer
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:101.5-3.el8_10.rocky.0.6
0:101.5-3.el8_10.rocky.0.6
osbuild-composer
Rocky Linux:9
From an advisory covering 5 CVEs
 before 0:165.1-5.el9_8.rocky.0.1
0:165.1-5.el9_8.rocky.0.1
github.com/labstack/echo/v4
Root:Go
 before v4.15.1-aikido.1
v4.15.1-aikido.1
rootio-github.com/labstack/echo/v4
Root:Go
 before v4.15.1-root.io.1
v4.15.1-root.io.1
govulncheck-vulndb
SUSE:Linux Enterprise Server 16.0
From an advisory covering 181 CVEs
 before 0.0.20260827T195228-160000.1.1
0.0.20260827T195228-160000.1.1
govulncheck-vulndb
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 181 CVEs
 before 0.0.20260827T195228-160000.1.1
0.0.20260827T195228-160000.1.1
golang-github-labstack-echo.v2
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.2.0-1
 None known
golang-github-labstack-echo.v3
Ubuntu:20.04:LTS
 All versions, plus listed versions
3.3.5-1
 None known
golang-github-labstack-echo
Ubuntu:22.04:LTS
 All versions, plus listed versions
4.2.1-2
 None known
golang-github-labstack-echo.v2
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.2.0-2
 None known
golang-github-labstack-echo.v3
Ubuntu:22.04:LTS
 All versions, plus listed versions
3.3.10-1
 None known
golang-github-labstack-echo
Ubuntu:24.04:LTS
 All versions, plus listed versions
4.11.1-2
 None known
golang-github-labstack-echo
Ubuntu:25.10
 All versions, plus listed versions
4.12.0-1
 None known
golang-github-labstack-echo
Ubuntu:26.10
 All versions, plus listed versions
4.12.0-1
 None known
golang-github-labstack-echo
Ubuntu:26.04:LTS
 All versions, plus listed versions
4.12.0-1
 None known
govulncheck-vulndb
openSUSE:Leap 16.0
From an advisory covering 181 CVEs
 before 0.0.20260827T195228-160000.1.1
0.0.20260827T195228-160000.1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-55677 is a high vulnerability (CVSS 7.5) in Labstack Echo, published June 26, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.52%, the 44th percentile. Fixed in github.com/labstack/echo/v5 5.2.0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 96 references and the rest of 2 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open