Wikimedia Foundation Echo vulnerabilities

• labstack echo Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto CVE-2026-118658 Fix available 4.7 MediumOctober 28, 2026
• labstack echo Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers CVE-2026-118657 Fix available 5.9 MediumOctober 28, 2026
• labstack echo Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI CVE-2026-118656 Fix available 6.1 MediumOctober 28, 2026
• labstack echo Echo: Static Middleware Double-Unescape Path Traversal CVE-2026-118655 Fix available 5.9 MediumOctober 28, 2026
• labstack echo Echo static file middleware route protection bypass via encoded dot-dot traversal CVE-2026-118654 Fix available 5.9 MediumOctober 28, 2026
• labstack echo Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration CVE-2026-118653 Fix available 5.3 MediumOctober 28, 2026
• labstack echo Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob CVE-2026-118652 Fix available 6.1 MediumOctober 28, 2026
• labstack echo Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default CVE-2026-118651 Fix available 5.3 MediumOctober 28, 2026
• labstack echo Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path CVE-2026-118650 Fix available 7.5 HighOctober 28, 2026
• labstack echo Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method CVE-2026-118266 Fix available 5.3 MediumOctober 28, 2026
• labstack echo Echo: X-Real-IP extractor trusts the header value instead of the sending peer CVE-2026-118265 Fix available 5.3 MediumOctober 23, 2026
• labstack echo Echo: WebSocket proxy can retain connections and handlers after client disconnect CVE-2026-118262 Fix available 8.2 HighOctober 23, 2026
• labstack echo Echo: Decompress permits unbounded gzip expansion in v4 CVE-2026-118261 Fix available 8.2 HighOctober 23, 2026
• labstack echo Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls CVE-2026-118264 Fix available 9.1 CriticalOctober 23, 2026
• labstack echo Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests CVE-2026-118263 Fix available 6.3 MediumOctober 23, 2026
• labstack echo Echo: BodyDump captures request and response bodies without size limits in v4 CVE-2026-118260 Fix available 8.2 HighOctober 23, 2026
• labstack echo Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files CVE-2026-55677 Fix available 7.5 HighJune 26, 2026
• wikimedia foundation echo Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation... CVE-2026-5266 Fix available 2.3 LowMay 11, 2026
• labstack echo Echo has a Windows path traversal via backslash in middleware.Static default filesystem CVE-2026-25766 Fix available 5.3 MediumFebruary 17, 2026
• ancorathemes echo WordPress Echo theme <= 1.15.0 - Local File Inclusion vulnerability CVE-2025-53432 8.1 HighDecember 18, 2025