github.com/labstack/echo/v4
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- Go
- Vulnerability status
- 17 advisory(ies) without a verdict
Advisories (17)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-23wf-92cp-8pcj Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto | < 4.15.2 | Undetermined |
| GHSA-2ffq-g2xg-c22p Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers | < 4.16.0 | Undetermined |
| GHSA-375p-5qhx-8wq4 Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path | < 4.16.0 | Undetermined |
| GHSA-3pmx-cf9f-34xr Echo static file middleware route protection bypass via encoded dot-dot traversal | < 4.16.0 | Undetermined |
| GHSA-9969-6676-49h5 Echo: WebSocket proxy can retain connections and handlers after client disconnect | 4.15.0 – < 4.16.1 | Undetermined |
| GHSA-crxj-hrmp-4rwf Labstack Echo Open Redirect vulnerability | < 4.9.0 | Undetermined |
| GHSA-cxf3-9h37-7rr8 Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls | 4.0.0 – < 4.16.1 | Undetermined |
| GHSA-f48p-c9v4-h7xv Echo: BodyDump captures request and response bodies without size limits in v4 | 4.0.0 – < 4.16.1 | Undetermined |
| GHSA-h7wr-284f-5qvc Echo: Decompress permits unbounded gzip expansion in v4 | 4.0.0 – < 4.16.1 | Undetermined |
| GHSA-h9g5-28mm-hx3g Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob | < 4.16.0 | Undetermined |
| GHSA-j453-hm5x-c46w Echo vulnerable to directory traversal | < 4.2.0 | Undetermined |
| GHSA-v753-g4cw-jm48 Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI | < 4.16.0 | Undetermined |
| GHSA-vfp3-v2gw-7wfq Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files | < 4.15.3 | Undetermined |
| GHSA-xwq5-6cqp-vx96 Echo has a Static Middleware Double-Unescape Path Traversal | < 4.15.3 | Undetermined |
| GO-2021-0051 Directory traversal on Windows in github.com/labstack/echo/v4 | < 4.1.18-0.20201215153152-4422e3b66b9f | Undetermined |
| GO-2022-1031 Open redirect in github.com/labstack/echo/v4 | < 4.9.0 | Undetermined |
| GO-2026-6293 Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5 | < 4.15.3 | Undetermined |
Sources
| Source | Licence |
|---|