Labstack Echo vulnerabilities

• labstack echo Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto CVE-2026-118658 Fix available 4.7 MediumOctober 28, 2026
• labstack echo Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers CVE-2026-118657 Fix available 5.9 MediumOctober 28, 2026
• labstack echo Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI CVE-2026-118656 Fix available 6.1 MediumOctober 28, 2026
• labstack echo Echo: Static Middleware Double-Unescape Path Traversal CVE-2026-118655 Fix available 5.9 MediumOctober 28, 2026
• labstack echo Echo static file middleware route protection bypass via encoded dot-dot traversal CVE-2026-118654 Fix available 5.9 MediumOctober 28, 2026
• labstack echo Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration CVE-2026-118653 Fix available 5.3 MediumOctober 28, 2026
• labstack echo Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob CVE-2026-118652 Fix available 6.1 MediumOctober 28, 2026
• labstack echo Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default CVE-2026-118651 Fix available 5.3 MediumOctober 28, 2026
• labstack echo Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path CVE-2026-118650 Fix available 7.5 HighOctober 28, 2026
• labstack echo Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method CVE-2026-118266 Fix available 5.3 MediumOctober 28, 2026
• labstack echo Echo: X-Real-IP extractor trusts the header value instead of the sending peer CVE-2026-118265 Fix available 5.3 MediumOctober 23, 2026
• labstack echo Echo: WebSocket proxy can retain connections and handlers after client disconnect CVE-2026-118262 Fix available 8.2 HighOctober 23, 2026
• labstack echo Echo: Decompress permits unbounded gzip expansion in v4 CVE-2026-118261 Fix available 8.2 HighOctober 23, 2026
• labstack echo Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls CVE-2026-118264 Fix available 9.1 CriticalOctober 23, 2026
• labstack echo Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests CVE-2026-118263 Fix available 6.3 MediumOctober 23, 2026
• labstack echo Echo: BodyDump captures request and response bodies without size limits in v4 CVE-2026-118260 Fix available 8.2 HighOctober 23, 2026
• labstack echo Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files CVE-2026-55677 Fix available 7.5 HighJune 26, 2026
• labstack echo Echo has a Windows path traversal via backslash in middleware.Static default filesystem CVE-2026-25766 Fix available 5.3 MediumFebruary 17, 2026
• labstack echo Labstack Echo Open Redirect vulnerability CVE-2022-40083 Fix available 9.6 CriticalSeptember 28, 2022
• github.com/labstack/echo/v4, labstack echo +1 more Directory traversal on Windows in github.com/labstack/echo/v4 CVE-2020-36565 Fix available 5.3 MediumApril 14, 2021